circle-ir 4.15.0 → 4.16.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/configs/sinks/golang.json +4 -4
- package/dist/analysis/config-loader.d.ts.map +1 -1
- package/dist/analysis/config-loader.js +11 -7
- package/dist/analysis/config-loader.js.map +1 -1
- package/dist/analysis/constant-caller-gate.d.ts +39 -0
- package/dist/analysis/constant-caller-gate.d.ts.map +1 -0
- package/dist/analysis/constant-caller-gate.js +298 -0
- package/dist/analysis/constant-caller-gate.js.map +1 -0
- package/dist/analysis/constant-propagation/evaluator.d.ts.map +1 -1
- package/dist/analysis/constant-propagation/evaluator.js +3 -1
- package/dist/analysis/constant-propagation/evaluator.js.map +1 -1
- package/dist/analysis/constant-propagation/patterns.d.ts +19 -0
- package/dist/analysis/constant-propagation/patterns.d.ts.map +1 -1
- package/dist/analysis/constant-propagation/patterns.js +33 -0
- package/dist/analysis/constant-propagation/patterns.js.map +1 -1
- package/dist/analysis/constant-propagation/propagator.d.ts +59 -0
- package/dist/analysis/constant-propagation/propagator.d.ts.map +1 -1
- package/dist/analysis/constant-propagation/propagator.js +396 -49
- package/dist/analysis/constant-propagation/propagator.js.map +1 -1
- package/dist/analysis/constant-propagation/types.d.ts +9 -0
- package/dist/analysis/constant-propagation/types.d.ts.map +1 -1
- package/dist/analysis/findings.d.ts.map +1 -1
- package/dist/analysis/findings.js +134 -0
- package/dist/analysis/findings.js.map +1 -1
- package/dist/analysis/interprocedural.d.ts.map +1 -1
- package/dist/analysis/interprocedural.js +127 -3
- package/dist/analysis/interprocedural.js.map +1 -1
- package/dist/analysis/java-array-element-keys.d.ts +14 -0
- package/dist/analysis/java-array-element-keys.d.ts.map +1 -0
- package/dist/analysis/java-array-element-keys.js +36 -0
- package/dist/analysis/java-array-element-keys.js.map +1 -0
- package/dist/analysis/js-crlf-strip.d.ts +26 -0
- package/dist/analysis/js-crlf-strip.d.ts.map +1 -0
- package/dist/analysis/js-crlf-strip.js +244 -0
- package/dist/analysis/js-crlf-strip.js.map +1 -0
- package/dist/analysis/passes/csharp-sanitizer-credit.d.ts +25 -0
- package/dist/analysis/passes/csharp-sanitizer-credit.d.ts.map +1 -1
- package/dist/analysis/passes/csharp-sanitizer-credit.js +157 -12
- package/dist/analysis/passes/csharp-sanitizer-credit.js.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts +38 -3
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +1234 -127
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/analysis/passes/param-source-flow-gate-pass.d.ts.map +1 -1
- package/dist/analysis/passes/param-source-flow-gate-pass.js +53 -1
- package/dist/analysis/passes/param-source-flow-gate-pass.js.map +1 -1
- package/dist/analysis/passes/plaintext-password-storage-pass.d.ts +6 -0
- package/dist/analysis/passes/plaintext-password-storage-pass.d.ts.map +1 -1
- package/dist/analysis/passes/plaintext-password-storage-pass.js +160 -0
- package/dist/analysis/passes/plaintext-password-storage-pass.js.map +1 -1
- package/dist/analysis/passes/scan-secrets-pass.d.ts +1 -1
- package/dist/analysis/passes/scan-secrets-pass.d.ts.map +1 -1
- package/dist/analysis/passes/scan-secrets-pass.js +7 -1
- package/dist/analysis/passes/scan-secrets-pass.js.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.js +326 -34
- package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
- package/dist/analysis/passes/taint-matcher-pass.d.ts.map +1 -1
- package/dist/analysis/passes/taint-matcher-pass.js +2 -2
- package/dist/analysis/passes/taint-matcher-pass.js.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.js +1376 -58
- package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
- package/dist/analysis/passes/weak-hash-pass.d.ts +6 -0
- package/dist/analysis/passes/weak-hash-pass.d.ts.map +1 -1
- package/dist/analysis/passes/weak-hash-pass.js +191 -4
- package/dist/analysis/passes/weak-hash-pass.js.map +1 -1
- package/dist/analysis/passes/weak-random-pass.d.ts +5 -0
- package/dist/analysis/passes/weak-random-pass.d.ts.map +1 -1
- package/dist/analysis/passes/weak-random-pass.js +30 -0
- package/dist/analysis/passes/weak-random-pass.js.map +1 -1
- package/dist/analysis/project-callee-escape-gate.d.ts +40 -0
- package/dist/analysis/project-callee-escape-gate.d.ts.map +1 -0
- package/dist/analysis/project-callee-escape-gate.js +243 -0
- package/dist/analysis/project-callee-escape-gate.js.map +1 -0
- package/dist/analysis/rust-literal-guard-rebind.d.ts +34 -0
- package/dist/analysis/rust-literal-guard-rebind.d.ts.map +1 -0
- package/dist/analysis/rust-literal-guard-rebind.js +197 -0
- package/dist/analysis/rust-literal-guard-rebind.js.map +1 -0
- package/dist/analysis/rust-literal-guard.d.ts +33 -0
- package/dist/analysis/rust-literal-guard.d.ts.map +1 -0
- package/dist/analysis/rust-literal-guard.js +422 -0
- package/dist/analysis/rust-literal-guard.js.map +1 -0
- package/dist/analysis/scalar-derivation.d.ts +8 -0
- package/dist/analysis/scalar-derivation.d.ts.map +1 -1
- package/dist/analysis/scalar-derivation.js +172 -0
- package/dist/analysis/scalar-derivation.js.map +1 -1
- package/dist/analysis/taint-matcher.d.ts +2 -2
- package/dist/analysis/taint-matcher.d.ts.map +1 -1
- package/dist/analysis/taint-matcher.js +531 -31
- package/dist/analysis/taint-matcher.js.map +1 -1
- package/dist/analysis/taint-propagation.d.ts +26 -1
- package/dist/analysis/taint-propagation.d.ts.map +1 -1
- package/dist/analysis/taint-propagation.js +234 -13
- package/dist/analysis/taint-propagation.js.map +1 -1
- package/dist/analyzer.d.ts +16 -2
- package/dist/analyzer.d.ts.map +1 -1
- package/dist/analyzer.js +13 -3
- package/dist/analyzer.js.map +1 -1
- package/dist/browser/circle-ir.js +24432 -19928
- package/dist/core/circle-ir-core.cjs +4936 -3575
- package/dist/core/circle-ir-core.js +4936 -3575
- package/dist/core/extractors/calls.d.ts +12 -1
- package/dist/core/extractors/calls.d.ts.map +1 -1
- package/dist/core/extractors/calls.js +332 -22
- package/dist/core/extractors/calls.js.map +1 -1
- package/dist/core/extractors/dfg.js +102 -10
- package/dist/core/extractors/dfg.js.map +1 -1
- package/dist/core/extractors/types.d.ts +5 -1
- package/dist/core/extractors/types.d.ts.map +1 -1
- package/dist/core/extractors/types.js +62 -0
- package/dist/core/extractors/types.js.map +1 -1
- package/dist/graph/analysis-pass.d.ts +6 -1
- package/dist/graph/analysis-pass.d.ts.map +1 -1
- package/dist/graph/analysis-pass.js +2 -1
- package/dist/graph/analysis-pass.js.map +1 -1
- package/dist/navigation/navigation-index.d.ts +134 -14
- package/dist/navigation/navigation-index.d.ts.map +1 -1
- package/dist/navigation/navigation-index.js +1158 -104
- package/dist/navigation/navigation-index.js.map +1 -1
- package/dist/navigation/types.d.ts +59 -2
- package/dist/navigation/types.d.ts.map +1 -1
- package/dist/resolution/cross-file.d.ts +9 -0
- package/dist/resolution/cross-file.d.ts.map +1 -1
- package/dist/resolution/cross-file.js +102 -43
- package/dist/resolution/cross-file.js.map +1 -1
- package/dist/resolution/type-hierarchy.d.ts +3 -0
- package/dist/resolution/type-hierarchy.d.ts.map +1 -1
- package/dist/resolution/type-hierarchy.js +45 -1
- package/dist/resolution/type-hierarchy.js.map +1 -1
- package/dist/types/index.d.ts +33 -0
- package/dist/types/index.d.ts.map +1 -1
- package/dist/types/index.js.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Constant-caller gate (cognium-dev#636, C# slice).
|
|
3
|
+
*
|
|
4
|
+
* Per-file analysis seeds every `string` parameter of a method as an
|
|
5
|
+
* `interprocedural_param` source, so a sink that receives the parameter is
|
|
6
|
+
* reported in the callee's file whether or not any caller passes tainted data.
|
|
7
|
+
* The cross-file phase already emits a path for each tainted caller, but the
|
|
8
|
+
* per-file flows are final before it runs. This project-level step runs after
|
|
9
|
+
* it and drops such a flow when every in-project caller is known to pass a
|
|
10
|
+
* constant at that parameter.
|
|
11
|
+
*
|
|
12
|
+
* A flow is dropped only when ALL of these hold; otherwise nothing changes:
|
|
13
|
+
* 1. C# file, flow seeded by `interprocedural_param` on parameter `P` of
|
|
14
|
+
* method `M`, and no other flow reaches the same sink from a real source.
|
|
15
|
+
* 2. `M` is not virtual / abstract / override / an interface member, and no
|
|
16
|
+
* project type derives from `M`'s type; the name is not overloaded in its type.
|
|
17
|
+
* 3. Every project call to a method of that name resolves exactly (the same
|
|
18
|
+
* resolution `CrossFilePass` uses) either to `M` or to some other exact
|
|
19
|
+
* target; one unresolved, inferred or polymorphic call keeps the flow.
|
|
20
|
+
* 4. At least one call resolves to `M`, and at every such call the argument at
|
|
21
|
+
* `P`'s position is a plain string literal, a literal local (`#636`), a
|
|
22
|
+
* local array whose element writes are all literals (`#638` step 1), or a
|
|
23
|
+
* parameter of the caller when every in-project caller of that method passes
|
|
24
|
+
* a constant at that parameter (transitive, depth ≤ 4, cycle-safe). Each relay
|
|
25
|
+
* method on the way must itself meet rules 2 and 3, so a relay that is
|
|
26
|
+
* virtual, overloaded or reached by a call that does not resolve exactly
|
|
27
|
+
* keeps the flow.
|
|
28
|
+
*/
|
|
29
|
+
import type { CircleIR, CallInfo } from '../types/index.js';
|
|
30
|
+
import type { ProjectGraph } from '../graph/project-graph.js';
|
|
31
|
+
/** True when local array `name` is declared in the caller and only ever holds string literals (cognium-dev#638 step 1). */
|
|
32
|
+
export declare function isLiteralArrayLocal(ir: CircleIR, lines: string[], call: CallInfo, name: string): boolean;
|
|
33
|
+
/** Direct constant at a call argument (exported for #638 unit tests). */
|
|
34
|
+
export declare function isConstantArg(ir: CircleIR, lines: string[], call: CallInfo, position: number): boolean;
|
|
35
|
+
export declare function applyConstantCallerGate(fileAnalyses: ReadonlyArray<{
|
|
36
|
+
file: string;
|
|
37
|
+
analysis: CircleIR;
|
|
38
|
+
}>, projectGraph: ProjectGraph, sourceLinesByFile: ReadonlyMap<string, string[]>): void;
|
|
39
|
+
//# sourceMappingURL=constant-caller-gate.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"constant-caller-gate.d.ts","sourceRoot":"","sources":["../../src/analysis/constant-caller-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAwB,MAAM,mBAAmB,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA8D9D,2HAA2H;AAC3H,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA6DxG;AAWD,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtG;AA4ED,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,EACjE,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAC/C,IAAI,CAiEN"}
|
|
@@ -0,0 +1,298 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Constant-caller gate (cognium-dev#636, C# slice).
|
|
3
|
+
*
|
|
4
|
+
* Per-file analysis seeds every `string` parameter of a method as an
|
|
5
|
+
* `interprocedural_param` source, so a sink that receives the parameter is
|
|
6
|
+
* reported in the callee's file whether or not any caller passes tainted data.
|
|
7
|
+
* The cross-file phase already emits a path for each tainted caller, but the
|
|
8
|
+
* per-file flows are final before it runs. This project-level step runs after
|
|
9
|
+
* it and drops such a flow when every in-project caller is known to pass a
|
|
10
|
+
* constant at that parameter.
|
|
11
|
+
*
|
|
12
|
+
* A flow is dropped only when ALL of these hold; otherwise nothing changes:
|
|
13
|
+
* 1. C# file, flow seeded by `interprocedural_param` on parameter `P` of
|
|
14
|
+
* method `M`, and no other flow reaches the same sink from a real source.
|
|
15
|
+
* 2. `M` is not virtual / abstract / override / an interface member, and no
|
|
16
|
+
* project type derives from `M`'s type; the name is not overloaded in its type.
|
|
17
|
+
* 3. Every project call to a method of that name resolves exactly (the same
|
|
18
|
+
* resolution `CrossFilePass` uses) either to `M` or to some other exact
|
|
19
|
+
* target; one unresolved, inferred or polymorphic call keeps the flow.
|
|
20
|
+
* 4. At least one call resolves to `M`, and at every such call the argument at
|
|
21
|
+
* `P`'s position is a plain string literal, a literal local (`#636`), a
|
|
22
|
+
* local array whose element writes are all literals (`#638` step 1), or a
|
|
23
|
+
* parameter of the caller when every in-project caller of that method passes
|
|
24
|
+
* a constant at that parameter (transitive, depth ≤ 4, cycle-safe). Each relay
|
|
25
|
+
* method on the way must itself meet rules 2 and 3, so a relay that is
|
|
26
|
+
* virtual, overloaded or reached by a call that does not resolve exactly
|
|
27
|
+
* keeps the flow.
|
|
28
|
+
*/
|
|
29
|
+
const STRING_LITERAL = /^@?"(?:[^"\\]|\\.)*"$/;
|
|
30
|
+
function typeFqn(type, ir) {
|
|
31
|
+
const pkg = type.package || ir.meta.package || '';
|
|
32
|
+
return pkg ? `${pkg}.${type.name}` : type.name;
|
|
33
|
+
}
|
|
34
|
+
function enclosingMethod(ir, line) {
|
|
35
|
+
let best;
|
|
36
|
+
for (const type of ir.types) {
|
|
37
|
+
for (const method of type.methods) {
|
|
38
|
+
if (line < method.start_line || line > method.end_line)
|
|
39
|
+
continue;
|
|
40
|
+
if (!best || method.end_line - method.start_line < best.method.end_line - best.method.start_line) {
|
|
41
|
+
best = { type, method };
|
|
42
|
+
}
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
return best;
|
|
46
|
+
}
|
|
47
|
+
/** True when local `name` is declared in the caller's method and assigned exactly once, a string literal. */
|
|
48
|
+
function isLiteralLocal(ir, lines, call, name) {
|
|
49
|
+
if (!/^[A-Za-z_]\w*$/.test(name))
|
|
50
|
+
return false;
|
|
51
|
+
const encl = enclosingMethod(ir, call.location.line);
|
|
52
|
+
if (!encl)
|
|
53
|
+
return false;
|
|
54
|
+
const { method } = encl;
|
|
55
|
+
if (method.parameters.some(p => p.name === name))
|
|
56
|
+
return false;
|
|
57
|
+
const assignOp = new RegExp(`(?<![\\w.])${name}\\s*(?:[-+*/%&|^?]|<<|>>)?=(?!=)`, 'g');
|
|
58
|
+
const literal = '@?"(?:[^"\\\\]|\\\\.)*"';
|
|
59
|
+
const declLiteral = new RegExp(`^\\s*(?:const\\s+)?[\\w<>\\[\\],.?]+\\s+${name}\\s*=\\s*${literal}\\s*;\\s*(?://.*)?$`);
|
|
60
|
+
const plainLiteral = new RegExp(`^\\s*${name}\\s*=\\s*${literal}\\s*;\\s*(?://.*)?$`);
|
|
61
|
+
const bareDecl = new RegExp(`^\\s*(?:const\\s+)?[\\w<>\\[\\],.?]+\\s+${name}\\s*;`);
|
|
62
|
+
const mutate = new RegExp(`\\b(?:out|ref)\\s+${name}\\b|(?:\\+\\+|--)\\s*${name}\\b|\\b${name}\\s*(?:\\+\\+|--)`);
|
|
63
|
+
let assignments = 0;
|
|
64
|
+
let assignLine = -1;
|
|
65
|
+
let assignIsDecl = false;
|
|
66
|
+
let declared = false;
|
|
67
|
+
for (let l = method.start_line; l <= method.end_line; l++) {
|
|
68
|
+
const text = lines[l - 1] ?? '';
|
|
69
|
+
const n = text.match(assignOp)?.length ?? 0;
|
|
70
|
+
assignments += n;
|
|
71
|
+
if (n > 0) {
|
|
72
|
+
assignLine = l;
|
|
73
|
+
assignIsDecl = declLiteral.test(text);
|
|
74
|
+
if (!assignIsDecl && !plainLiteral.test(text))
|
|
75
|
+
return false;
|
|
76
|
+
}
|
|
77
|
+
if (bareDecl.test(text))
|
|
78
|
+
declared = true;
|
|
79
|
+
if (mutate.test(text))
|
|
80
|
+
return false;
|
|
81
|
+
}
|
|
82
|
+
// One assignment, a string literal, before the call; a plain `x = "lit";` needs a local `T x;` declaration.
|
|
83
|
+
return assignments === 1 && assignLine > 0 && assignLine < call.location.line && (assignIsDecl || declared);
|
|
84
|
+
}
|
|
85
|
+
const LITERAL_IN_BRACES = /^@?"(?:[^"\\]|\\.)*"(?:\s*,\s*@?"(?:[^"\\]|\\.)*")*\s*$/;
|
|
86
|
+
/** True when local array `name` is declared in the caller and only ever holds string literals (cognium-dev#638 step 1). */
|
|
87
|
+
export function isLiteralArrayLocal(ir, lines, call, name) {
|
|
88
|
+
if (!/^[A-Za-z_]\w*$/.test(name))
|
|
89
|
+
return false;
|
|
90
|
+
const encl = enclosingMethod(ir, call.location.line);
|
|
91
|
+
if (!encl)
|
|
92
|
+
return false;
|
|
93
|
+
const { method } = encl;
|
|
94
|
+
if (method.parameters.some(p => p.name === name))
|
|
95
|
+
return false;
|
|
96
|
+
const declNew = new RegExp(`^\\s*(?:var\\s+)?[\\w<>\\[\\],\\s]*\\b${name}\\s*=\\s*new\\s+[\\w<>\\[\\],\\s]+\\[\\s*\\d+\\s*\\]\\s*;\\s*(?://.*)?$`);
|
|
97
|
+
const declInit = new RegExp(`^\\s*(?:var\\s+)?[\\w<>\\[\\],\\s]*\\b${name}\\s*=\\s*(?:new\\s+[\\w<>\\[\\],\\s]+\\[\\s*\\]\\s*)?\\{([^}]*)\\}\\s*;\\s*(?://.*)?$`);
|
|
98
|
+
const plainReassign = new RegExp(`^\\s*${name}\\s*(?![\\[])(?:[-+*/%&|^?]|<<|>>)?=(?!=)`);
|
|
99
|
+
const elementWrite = new RegExp(`^\\s*${name}\\s*\\[[^\\]]+\\]\\s*=\\s*(.+?)\\s*;\\s*(?://.*)?$`);
|
|
100
|
+
const alias = new RegExp(`^\\s*\\w+\\s*=\\s*${name}\\s*;`);
|
|
101
|
+
const mutate = new RegExp(`\\b(?:out|ref)\\s+${name}\\b|(?:\\+\\+|--)\\s*${name}\\b|\\b${name}\\s*(?:\\+\\+|--)`);
|
|
102
|
+
const copyStyle = new RegExp(`\\b(?:Array\\.Copy|CopyTo|\\.Add)\\s*\\([^)]*\\b${name}\\b`);
|
|
103
|
+
let declared = false;
|
|
104
|
+
let declLine = -1;
|
|
105
|
+
for (let l = method.start_line; l <= method.end_line; l++) {
|
|
106
|
+
const text = lines[l - 1] ?? '';
|
|
107
|
+
if (mutate.test(text) || alias.test(text) || copyStyle.test(text))
|
|
108
|
+
return false;
|
|
109
|
+
const initMatch = declInit.exec(text);
|
|
110
|
+
if (initMatch) {
|
|
111
|
+
declared = true;
|
|
112
|
+
declLine = l;
|
|
113
|
+
const inner = (initMatch[1] ?? '').trim();
|
|
114
|
+
if (inner.length > 0 && !LITERAL_IN_BRACES.test(inner))
|
|
115
|
+
return false;
|
|
116
|
+
continue;
|
|
117
|
+
}
|
|
118
|
+
if (declNew.test(text)) {
|
|
119
|
+
declared = true;
|
|
120
|
+
declLine = l;
|
|
121
|
+
continue;
|
|
122
|
+
}
|
|
123
|
+
const ew = elementWrite.exec(text);
|
|
124
|
+
if (ew) {
|
|
125
|
+
const rhs = ew[1].trim();
|
|
126
|
+
if (STRING_LITERAL.test(rhs))
|
|
127
|
+
continue;
|
|
128
|
+
if (/^[A-Za-z_]\w*$/.test(rhs) && isLiteralLocal(ir, lines, call, rhs))
|
|
129
|
+
continue;
|
|
130
|
+
return false;
|
|
131
|
+
}
|
|
132
|
+
if (l !== declLine && plainReassign.test(text))
|
|
133
|
+
return false;
|
|
134
|
+
}
|
|
135
|
+
if (!declared)
|
|
136
|
+
return false;
|
|
137
|
+
for (const c of ir.calls) {
|
|
138
|
+
if (c.location.line < method.start_line || c.location.line > method.end_line)
|
|
139
|
+
continue;
|
|
140
|
+
if (c.location.line >= call.location.line)
|
|
141
|
+
continue;
|
|
142
|
+
if (c === call)
|
|
143
|
+
continue;
|
|
144
|
+
if (c.arguments.some(a => (a.variable ?? a.expression?.trim()) === name))
|
|
145
|
+
return false;
|
|
146
|
+
}
|
|
147
|
+
return true;
|
|
148
|
+
}
|
|
149
|
+
function isDirectConstantArg(ir, lines, call, position) {
|
|
150
|
+
const arg = call.arguments.find(a => a.position === position);
|
|
151
|
+
if (!arg)
|
|
152
|
+
return false;
|
|
153
|
+
const expr = (arg.expression ?? '').trim();
|
|
154
|
+
if (STRING_LITERAL.test(expr))
|
|
155
|
+
return true;
|
|
156
|
+
if (arg.variable && expr === arg.variable && isLiteralLocal(ir, lines, call, arg.variable))
|
|
157
|
+
return true;
|
|
158
|
+
return !!arg.variable && expr === arg.variable && isLiteralArrayLocal(ir, lines, call, arg.variable);
|
|
159
|
+
}
|
|
160
|
+
/** Direct constant at a call argument (exported for #638 unit tests). */
|
|
161
|
+
export function isConstantArg(ir, lines, call, position) {
|
|
162
|
+
return isDirectConstantArg(ir, lines, call, position);
|
|
163
|
+
}
|
|
164
|
+
/**
|
|
165
|
+
* Rule 2 of the header: a method whose callers can be enumerated exactly. Applied to the
|
|
166
|
+
* sink's method and to every relay method the transitive step walks through, so a virtual,
|
|
167
|
+
* overridden, interface or overloaded relay keeps the flow.
|
|
168
|
+
*/
|
|
169
|
+
function hasEnumerableCallers(type, method, derivedFrom) {
|
|
170
|
+
if (type.kind !== 'class')
|
|
171
|
+
return false;
|
|
172
|
+
if (method.modifiers.some(m => m === 'virtual' || m === 'abstract' || m === 'override'))
|
|
173
|
+
return false;
|
|
174
|
+
if (derivedFrom.has(type.name))
|
|
175
|
+
return false;
|
|
176
|
+
return type.methods.filter(m => m.name === method.name).length === 1;
|
|
177
|
+
}
|
|
178
|
+
const TRANSITIVE_MAX_DEPTH = 4;
|
|
179
|
+
function isConstantArgRecursive(ctx, ir, lines, call, position, depth, visiting) {
|
|
180
|
+
if (isDirectConstantArg(ir, lines, call, position))
|
|
181
|
+
return true;
|
|
182
|
+
if (depth >= TRANSITIVE_MAX_DEPTH)
|
|
183
|
+
return false;
|
|
184
|
+
const arg = call.arguments.find(a => a.position === position);
|
|
185
|
+
if (!arg?.variable || (arg.expression ?? '').trim() !== arg.variable)
|
|
186
|
+
return false;
|
|
187
|
+
const encl = enclosingMethod(ir, call.location.line);
|
|
188
|
+
if (!encl)
|
|
189
|
+
return false;
|
|
190
|
+
if (!hasEnumerableCallers(encl.type, encl.method, ctx.derivedFrom))
|
|
191
|
+
return false;
|
|
192
|
+
const paramIdx = encl.method.parameters.findIndex(p => p.name === arg.variable);
|
|
193
|
+
if (paramIdx < 0)
|
|
194
|
+
return false;
|
|
195
|
+
const fqn = `${typeFqn(encl.type, ir)}.${encl.method.name}`;
|
|
196
|
+
const visitKey = `${fqn}:${paramIdx}`;
|
|
197
|
+
if (visiting.has(visitKey))
|
|
198
|
+
return false;
|
|
199
|
+
visiting.add(visitKey);
|
|
200
|
+
let resolvedToMethod = 0;
|
|
201
|
+
for (const site of ctx.callsByName.get(encl.method.name) ?? []) {
|
|
202
|
+
const r = ctx.resolver.resolveCall(site.call, site.file);
|
|
203
|
+
// Rule 3, as at the sink: one call of this name that does not resolve exactly might be
|
|
204
|
+
// this relay receiving tainted data, so the relay's argument is not known to be constant.
|
|
205
|
+
if (!r || r.resolution !== 'exact') {
|
|
206
|
+
visiting.delete(visitKey);
|
|
207
|
+
return false;
|
|
208
|
+
}
|
|
209
|
+
if (r.targetMethod !== fqn)
|
|
210
|
+
continue;
|
|
211
|
+
const callerIr = ctx.fileAnalyses.find(f => f.file === site.file)?.analysis;
|
|
212
|
+
const callerLines = ctx.sourceLinesByFile.get(site.file);
|
|
213
|
+
if (!callerIr || !callerLines) {
|
|
214
|
+
visiting.delete(visitKey);
|
|
215
|
+
return false;
|
|
216
|
+
}
|
|
217
|
+
if (!isConstantArgRecursive(ctx, callerIr, callerLines, site.call, paramIdx, depth + 1, visiting)) {
|
|
218
|
+
visiting.delete(visitKey);
|
|
219
|
+
return false;
|
|
220
|
+
}
|
|
221
|
+
resolvedToMethod++;
|
|
222
|
+
}
|
|
223
|
+
visiting.delete(visitKey);
|
|
224
|
+
return resolvedToMethod > 0;
|
|
225
|
+
}
|
|
226
|
+
export function applyConstantCallerGate(fileAnalyses, projectGraph, sourceLinesByFile) {
|
|
227
|
+
const candidates = fileAnalyses.filter(fa => fa.analysis.meta.language === 'csharp'
|
|
228
|
+
&& (fa.analysis.taint?.flows ?? []).some(f => f.source_type === 'interprocedural_param'));
|
|
229
|
+
if (candidates.length === 0)
|
|
230
|
+
return;
|
|
231
|
+
const resolver = projectGraph.resolver;
|
|
232
|
+
const csharp = fileAnalyses.filter(fa => fa.analysis.meta.language === 'csharp');
|
|
233
|
+
const callsByName = new Map();
|
|
234
|
+
const derivedFrom = new Set();
|
|
235
|
+
for (const fa of csharp) {
|
|
236
|
+
for (const call of fa.analysis.calls) {
|
|
237
|
+
const arr = callsByName.get(call.method_name) ?? [];
|
|
238
|
+
arr.push({ file: fa.file, call });
|
|
239
|
+
callsByName.set(call.method_name, arr);
|
|
240
|
+
}
|
|
241
|
+
for (const type of fa.analysis.types) {
|
|
242
|
+
if (type.extends)
|
|
243
|
+
derivedFrom.add(type.extends.split('.').pop() ?? type.extends);
|
|
244
|
+
for (const i of type.implements)
|
|
245
|
+
derivedFrom.add(i.split('.').pop() ?? i);
|
|
246
|
+
}
|
|
247
|
+
}
|
|
248
|
+
const gateCtx = {
|
|
249
|
+
fileAnalyses,
|
|
250
|
+
callsByName,
|
|
251
|
+
resolver,
|
|
252
|
+
sourceLinesByFile,
|
|
253
|
+
derivedFrom,
|
|
254
|
+
};
|
|
255
|
+
for (const fa of candidates) {
|
|
256
|
+
const ir = fa.analysis;
|
|
257
|
+
const flows = ir.taint.flows ?? [];
|
|
258
|
+
const kept = flows.filter(flow => {
|
|
259
|
+
if (flow.source_type !== 'interprocedural_param')
|
|
260
|
+
return true;
|
|
261
|
+
const variable = flow.path[0]?.variable;
|
|
262
|
+
if (!variable)
|
|
263
|
+
return true;
|
|
264
|
+
if (flows.some(o => o !== flow && o.sink_line === flow.sink_line && o.source_type !== 'interprocedural_param'))
|
|
265
|
+
return true;
|
|
266
|
+
const src = (ir.taint.sources ?? []).find(s => s.type === 'interprocedural_param' && s.line === flow.source_line && s.variable === variable);
|
|
267
|
+
if (!src?.in_method)
|
|
268
|
+
return true;
|
|
269
|
+
const encl = enclosingMethod(ir, flow.source_line);
|
|
270
|
+
if (!encl || encl.method.name !== src.in_method)
|
|
271
|
+
return true;
|
|
272
|
+
const { type, method } = encl;
|
|
273
|
+
if (!hasEnumerableCallers(type, method, derivedFrom))
|
|
274
|
+
return true;
|
|
275
|
+
const position = method.parameters.findIndex(p => p.name === variable);
|
|
276
|
+
if (position < 0)
|
|
277
|
+
return true;
|
|
278
|
+
const fqn = `${typeFqn(type, ir)}.${method.name}`;
|
|
279
|
+
let resolvedToMethod = 0;
|
|
280
|
+
for (const site of callsByName.get(method.name) ?? []) {
|
|
281
|
+
const r = resolver.resolveCall(site.call, site.file);
|
|
282
|
+
if (!r || r.resolution !== 'exact')
|
|
283
|
+
return true;
|
|
284
|
+
if (r.targetMethod !== fqn)
|
|
285
|
+
continue;
|
|
286
|
+
const callerIr = fileAnalyses.find(f => f.file === site.file)?.analysis;
|
|
287
|
+
const lines = sourceLinesByFile.get(site.file);
|
|
288
|
+
if (!callerIr || !lines || !isConstantArgRecursive(gateCtx, callerIr, lines, site.call, position, 0, new Set()))
|
|
289
|
+
return true;
|
|
290
|
+
resolvedToMethod++;
|
|
291
|
+
}
|
|
292
|
+
return resolvedToMethod === 0;
|
|
293
|
+
});
|
|
294
|
+
if (kept.length !== flows.length)
|
|
295
|
+
ir.taint.flows = kept;
|
|
296
|
+
}
|
|
297
|
+
}
|
|
298
|
+
//# sourceMappingURL=constant-caller-gate.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"constant-caller-gate.js","sourceRoot":"","sources":["../../src/analysis/constant-caller-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAO/C,SAAS,OAAO,CAAC,IAAc,EAAE,EAAY;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAClD,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,EAAY,EAAE,IAAY;IACjD,IAAI,IAAwD,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ;gBAAE,SAAS;YACjE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACjG,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6GAA6G;AAC7G,SAAS,cAAc,CAAC,EAAY,EAAE,KAAe,EAAE,IAAc,EAAE,IAAY;IACjF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,cAAc,IAAI,kCAAkC,EAAE,GAAG,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,yBAAyB,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,2CAA2C,IAAI,YAAY,OAAO,qBAAqB,CAAC,CAAC;IACxH,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,YAAY,OAAO,qBAAqB,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,2CAA2C,IAAI,OAAO,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,qBAAqB,IAAI,wBAAwB,IAAI,UAAU,IAAI,mBAAmB,CAAC,CAAC;IAClH,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;QAC5C,WAAW,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,UAAU,GAAG,CAAC,CAAC;YACf,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC9D,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACtC,CAAC;IACD,4GAA4G;IAC5G,OAAO,WAAW,KAAK,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;AAC9G,CAAC;AAED,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF,2HAA2H;AAC3H,MAAM,UAAU,mBAAmB,CAAC,EAAY,EAAE,KAAe,EAAE,IAAc,EAAE,IAAY;IAC7F,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/D,MAAM,OAAO,GAAG,IAAI,MAAM,CACxB,yCAAyC,IAAI,yEAAyE,CACvH,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,yCAAyC,IAAI,uFAAuF,CACrI,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,2CAA2C,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,oDAAoD,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,qBAAqB,IAAI,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,qBAAqB,IAAI,wBAAwB,IAAI,UAAU,IAAI,mBAAmB,CAAC,CAAC;IAClH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,mDAAmD,IAAI,KAAK,CAAC,CAAC;IAE3F,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAElB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAEhF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACrE,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;gBAAE,SAAS;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ;YAAE,SAAS;QACvF,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,SAAS;QACpD,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QACzB,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACzF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,EAAY,EAAE,KAAe,EAAE,IAAc,EAAE,QAAgB;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,KAAK,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxG,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,KAAK,GAAG,CAAC,QAAQ,IAAI,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;AACvG,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,EAAY,EAAE,KAAe,EAAE,IAAc,EAAE,QAAgB;IAC3F,OAAO,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAUD;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,IAAc,EAAE,MAAkB,EAAE,WAAgC;IAChG,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACtG,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,SAAS,sBAAsB,CAC7B,GAAsB,EACtB,EAAY,EACZ,KAAe,EACf,IAAc,EACd,QAAgB,EAChB,KAAa,EACb,QAAqB;IAErB,IAAI,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,KAAK,IAAI,oBAAoB;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEnF,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;IACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,uFAAuF;QACvF,0FAA0F;QAC1F,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACnC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,KAAK,GAAG;YAAE,SAAS;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;QAC5E,MAAM,WAAW,GAAG,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,gBAAgB,EAAE,CAAC;IACrB,CAAC;IACD,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,OAAO,gBAAgB,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,YAAiE,EACjE,YAA0B,EAC1B,iBAAgD;IAEhD,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAC1C,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ;WACnC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,uBAAuB,CAAC,CAAC,CAAC;IAC5F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IACvC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,OAAO;gBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;YACjF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAsB;QACjC,YAAY;QACZ,WAAW;QACX,QAAQ;QACR,iBAAiB;QACjB,WAAW;KACZ,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;YAC/B,IAAI,IAAI,CAAC,WAAW,KAAK,uBAAuB;gBAAE,OAAO,IAAI,CAAC;YAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YACxC,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,uBAAuB,CAAC;gBAAE,OAAO,IAAI,CAAC;YAE5H,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC5C,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAChG,IAAI,CAAC,GAAG,EAAE,SAAS;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC7D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YAE9B,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACvE,IAAI,QAAQ,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,gBAAgB,GAAG,CAAC,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO;oBAAE,OAAO,IAAI,CAAC;gBAChD,IAAI,CAAC,CAAC,YAAY,KAAK,GAAG;oBAAE,SAAS;gBACrC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;gBACxE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC7H,gBAAgB,EAAE,CAAC;YACrB,CAAC;YACD,OAAO,gBAAgB,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IAC1D,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD;;;;;GAKG;AACH,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS;IAFnB,YACU,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,EAC5D;IAEJ;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,aAAa,
|
|
1
|
+
{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD;;;;;GAKG;AACH,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,SAAS;IAFnB,YACU,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,aAAa,GAAG,SAAS,EAC5D;IAEJ;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,aAAa,CAiFlC;IAED,OAAO,CAAC,cAAc;IA8FtB,OAAO,CAAC,aAAa;IA+BrB,OAAO,CAAC,eAAe;IAuBvB,OAAO,CAAC,kBAAkB;IAuE1B,OAAO,CAAC,mBAAmB;IAe3B;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,IAAI,GAAG,aAAa,EAAE,CAQjD;IAED,OAAO,CAAC,YAAY;CAWrB"}
|
|
@@ -32,7 +32,9 @@ export class ExpressionEvaluator {
|
|
|
32
32
|
case 'decimal_floating_point_literal':
|
|
33
33
|
return createConstant(parseFloat(text), 'float', line);
|
|
34
34
|
case 'string_literal':
|
|
35
|
-
|
|
35
|
+
case 'interpreted_string_literal':
|
|
36
|
+
case 'raw_string_literal':
|
|
37
|
+
return createConstant(node.type === 'raw_string_literal' ? text.slice(1, -1) : text.slice(1, -1), 'string', line);
|
|
36
38
|
case 'character_literal': {
|
|
37
39
|
let char = text.slice(1, -1);
|
|
38
40
|
if (char.startsWith('\\')) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElG;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IAEpB,MAAM;IACN,SAAS;IAFnB,YACU,MAAc,EACd,SAAsD;sBADtD,MAAM;yBACN,SAAS;IAChB,CAAC;IAEJ;;OAEG;IACH,QAAQ,CAAC,IAAU;QACjB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,WAAW;YACX,KAAK,yBAAyB,CAAC;YAC/B,KAAK,qBAAqB,CAAC;YAC3B,KAAK,uBAAuB;gBAC1B,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAEzD,KAAK,gCAAgC;gBACnC,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAEzD,KAAK,gBAAgB;gBACnB,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAE3D,KAAK,mBAAmB,EAAE,CAAC;gBACzB,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YAED,KAAK,MAAM;gBACT,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5C,KAAK,OAAO;gBACV,OAAO,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE7C,KAAK,cAAc;gBACjB,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5C,qBAAqB;YACrB,KAAK,YAAY,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAED,2BAA2B;YAC3B,KAAK,0BAA0B,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;gBAChF,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAED,oBAAoB;YACpB,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAEnC,mBAAmB;YACnB,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAElC,qBAAqB;YACrB,KAAK,oBAAoB;gBACvB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAEpC,oBAAoB;YACpB,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAEvC,eAAe;YACf,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAExC;gBACE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,IAAU;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAExD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,aAAa;YACb,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACrD,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACjE,CAAC;gBACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;oBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;gBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;gBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/E,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;oBACjD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/E,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAED,aAAa;YACb,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;YAED,UAAU;YACV,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,aAAa,CAAC,IAAU;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEtD,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAuB,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,eAAe,CAAC,IAAU;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAE1D,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE3C,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpD,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,kBAAkB,CAAC,IAAU;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvB,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,iBAAiB;QACjB,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;YAEzB,IAAI,UAAU,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACjF,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBACzC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;wBAC/B,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,UAAU,KAAK,WAAW,IAAI,QAAQ,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACnF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBAC3C,OAAO,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBACzC,OAAO,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpF,OAAO,cAAc,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,mBAAmB,CAAC,IAAU;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,mBAAmB;QACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,OAAO,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,OAAO,cAAc,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,QAAc;QAC9B,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,KAAK,EAAE,OAAO,IAAI,CAAC;YACxB,KAAK,KAAK,EAAE,OAAO,IAAI,CAAC;YACxB,KAAK,KAAK,EAAE,OAAO,IAAI,CAAC;YACxB,KAAK,MAAM,EAAE,OAAO,IAAI,CAAC;YACzB,KAAK,KAAK,EAAE,OAAO,GAAG,CAAC;YACvB,KAAK,KAAK,EAAE,OAAO,GAAG,CAAC;YACvB,SAAS,OAAO,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}
|
|
1
|
+
{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElG;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IAEpB,MAAM;IACN,SAAS;IAFnB,YACU,MAAc,EACd,SAAsD;sBADtD,MAAM;yBACN,SAAS;IAChB,CAAC;IAEJ;;OAEG;IACH,QAAQ,CAAC,IAAU;QACjB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,WAAW;YACX,KAAK,yBAAyB,CAAC;YAC/B,KAAK,qBAAqB,CAAC;YAC3B,KAAK,uBAAuB;gBAC1B,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAEzD,KAAK,gCAAgC;gBACnC,OAAO,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAEzD,KAAK,gBAAgB,CAAC;YACtB,KAAK,4BAA4B,CAAC;YAClC,KAAK,oBAAoB;gBACvB,OAAO,cAAc,CACnB,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAC1E,QAAQ,EACR,IAAI,CACL,CAAC;YAEJ,KAAK,mBAAmB,EAAE,CAAC;gBACzB,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5C,CAAC;YAED,KAAK,MAAM;gBACT,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5C,KAAK,OAAO;gBACV,OAAO,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE7C,KAAK,cAAc;gBACjB,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAE5C,qBAAqB;YACrB,KAAK,YAAY,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAED,2BAA2B;YAC3B,KAAK,0BAA0B,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;gBAChF,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;gBACD,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAED,oBAAoB;YACpB,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAEnC,mBAAmB;YACnB,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAElC,qBAAqB;YACrB,KAAK,oBAAoB;gBACvB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAEpC,oBAAoB;YACpB,KAAK,mBAAmB;gBACtB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAEvC,eAAe;YACf,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAExC;gBACE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,IAAU;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAExD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACzB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,aAAa;YACb,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACrD,OAAO,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACjE,CAAC;gBACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;oBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;gBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC;gBACvB,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/E,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;oBACjD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/E,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAED,aAAa;YACb,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,cAAc,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;YAED,UAAU;YACV,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;YAED,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,aAAa,CAAC,IAAU;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEtD,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,cAAc,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,IAAuB,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,eAAe,CAAC,IAAU;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAE1D,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE3C,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpD,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,kBAAkB,CAAC,IAAU;QACnC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvB,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,iBAAiB;QACjB,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;YAEzB,IAAI,UAAU,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACjF,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBACzC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;wBAC/B,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,UAAU,KAAK,WAAW,IAAI,QAAQ,EAAE,CAAC;gBAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBACnF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBAC3C,OAAO,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,CAAC;gBACD,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBAC3C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC;oBACzC,OAAO,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpF,OAAO,cAAc,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;YAED,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,mBAAmB,CAAC,IAAU;QACpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5C,mBAAmB;QACnB,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,OAAO,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,OAAO,cAAc,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,QAAc;QAC9B,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBACnE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,KAAK,EAAE,OAAO,IAAI,CAAC;YACxB,KAAK,KAAK,EAAE,OAAO,IAAI,CAAC;YACxB,KAAK,KAAK,EAAE,OAAO,IAAI,CAAC;YACxB,KAAK,MAAM,EAAE,OAAO,IAAI,CAAC;YACzB,KAAK,KAAK,EAAE,OAAO,GAAG,CAAC;YACvB,KAAK,KAAK,EAAE,OAAO,GAAG,CAAC;YACvB,SAAS,OAAO,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}
|
|
@@ -4,6 +4,25 @@
|
|
|
4
4
|
export declare const TAINT_PATTERNS: string[];
|
|
5
5
|
export declare const TAINT_PATTERN_REGEX: RegExp;
|
|
6
6
|
export declare const SANITIZER_METHODS: Set<string>;
|
|
7
|
+
/**
|
|
8
|
+
* Context-specific HTML / markup / script encoders (cognium-dev#589).
|
|
9
|
+
*
|
|
10
|
+
* A local assigned from one of these is clean for the output-encoding sinks but
|
|
11
|
+
* not for `trust_boundary`. The constant propagator records this per variable so
|
|
12
|
+
* that the clean-variable sink filter does not drop a `trust_boundary` sink on a
|
|
13
|
+
* session `setAttribute`. Every method here is a registered sanitizer
|
|
14
|
+
* whose config row removes `xss` and nothing else; a drift test pins that.
|
|
15
|
+
* Families that are NOT listed (type casts, SQL/LDAP/path codecs, URL encoders)
|
|
16
|
+
* keep their existing all-sinks behaviour.
|
|
17
|
+
*/
|
|
18
|
+
export declare const HTML_CONTEXT_ENCODER_METHODS: ReadonlySet<string>;
|
|
19
|
+
/**
|
|
20
|
+
* Sink types an HTML-context encoder does NOT clean. `trust_boundary`
|
|
21
|
+
* (CWE-501, a tainted value stored in a session / trusted container) is not an
|
|
22
|
+
* output-encoding concern: an encoded value is still untrusted data crossing
|
|
23
|
+
* the boundary (#589). Every other sink type keeps its existing credit.
|
|
24
|
+
*/
|
|
25
|
+
export declare const HTML_CONTEXT_ENCODER_UNCOVERED_SINKS: ReadonlySet<string>;
|
|
7
26
|
export declare const ANTI_SANITIZER_METHODS: Set<string>;
|
|
8
27
|
export declare const PROPAGATOR_METHODS: Set<string>;
|
|
9
28
|
//# sourceMappingURL=patterns.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,eAAO,MAAM,cAAc,UAgE1B,CAAC;AAGF,eAAO,MAAM,mBAAmB,QAE/B,CAAC;AAMF,eAAO,MAAM,iBAAiB,aAqD5B,CAAC;
|
|
1
|
+
{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,eAAO,MAAM,cAAc,UAgE1B,CAAC;AAGF,eAAO,MAAM,mBAAmB,QAE/B,CAAC;AAMF,eAAO,MAAM,iBAAiB,aAqD5B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,MAAM,CAc3D,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAOrG,eAAO,MAAM,sBAAsB,aA4BjC,CAAC;AAOH,eAAO,MAAM,kBAAkB,aA8B7B,CAAC"}
|
|
@@ -112,6 +112,39 @@ export const SANITIZER_METHODS = new Set([
|
|
|
112
112
|
// Python
|
|
113
113
|
'int', 'float', 'bool',
|
|
114
114
|
]);
|
|
115
|
+
/**
|
|
116
|
+
* Context-specific HTML / markup / script encoders (cognium-dev#589).
|
|
117
|
+
*
|
|
118
|
+
* A local assigned from one of these is clean for the output-encoding sinks but
|
|
119
|
+
* not for `trust_boundary`. The constant propagator records this per variable so
|
|
120
|
+
* that the clean-variable sink filter does not drop a `trust_boundary` sink on a
|
|
121
|
+
* session `setAttribute`. Every method here is a registered sanitizer
|
|
122
|
+
* whose config row removes `xss` and nothing else; a drift test pins that.
|
|
123
|
+
* Families that are NOT listed (type casts, SQL/LDAP/path codecs, URL encoders)
|
|
124
|
+
* keep their existing all-sinks behaviour.
|
|
125
|
+
*/
|
|
126
|
+
export const HTML_CONTEXT_ENCODER_METHODS = new Set([
|
|
127
|
+
// ESAPI
|
|
128
|
+
'encodeForHTML', 'encodeForHTMLAttribute', 'encodeForJavaScript', 'encodeForCSS',
|
|
129
|
+
'encodeForXML', 'encodeForXMLAttribute',
|
|
130
|
+
// OWASP Java Encoder
|
|
131
|
+
'forHtml', 'forHtmlAttribute', 'forHtmlContent', 'forHtmlUnquotedAttribute',
|
|
132
|
+
'forJavaScript', 'forJavaScriptBlock', 'forJavaScriptAttribute', 'forJavaScriptSource',
|
|
133
|
+
'forCssString', 'forCssUrl', 'forXml', 'forXmlAttribute', 'forXmlContent',
|
|
134
|
+
'forXmlComment', 'forCDATA',
|
|
135
|
+
// Apache Commons StringEscapeUtils
|
|
136
|
+
'escapeHtml', 'escapeHtml3', 'escapeHtml4', 'escapeXml', 'escapeXml10', 'escapeXml11',
|
|
137
|
+
'escapeEcmaScript',
|
|
138
|
+
// Spring HtmlUtils
|
|
139
|
+
'htmlEscape', 'htmlEscapeDecimal', 'htmlEscapeHex',
|
|
140
|
+
]);
|
|
141
|
+
/**
|
|
142
|
+
* Sink types an HTML-context encoder does NOT clean. `trust_boundary`
|
|
143
|
+
* (CWE-501, a tainted value stored in a session / trusted container) is not an
|
|
144
|
+
* output-encoding concern: an encoded value is still untrusted data crossing
|
|
145
|
+
* the boundary (#589). Every other sink type keeps its existing credit.
|
|
146
|
+
*/
|
|
147
|
+
export const HTML_CONTEXT_ENCODER_UNCOVERED_SINKS = new Set(['trust_boundary']);
|
|
115
148
|
// =============================================================================
|
|
116
149
|
// Anti-Sanitizer Methods
|
|
117
150
|
// These methods REVERSE sanitization - calling them on sanitized input produces tainted output
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,6BAA6B;IAC7B,sBAAsB;IACtB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,mBAAmB;IACnB,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,cAAc;IACd,YAAY,EAAG,oBAAoB;IACnC,cAAc;IACd,aAAa;IAEb,0DAA0D;IAC1D,sBAAsB;IACtB,oBAAoB;IACpB,eAAe;IAEf,cAAc;IACd,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;IACrB,eAAe;IAEf,kBAAkB;IAClB,wBAAwB;IACxB,cAAc;IAEd,mBAAmB;IACnB,aAAa;IACb,aAAa;IAEb,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IAErB,mCAAmC;IACnC,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,cAAc;IACd,sBAAsB;IACtB,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5E,CAAC;AAEF,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,eAAe,EAAE,wBAAwB,EAAE,qBAAqB;IAChE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB;IACvE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc;IAChE,aAAa,EAAE,iBAAiB,EAAE,cAAc;IAEhD,qBAAqB;IACrB,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,0BAA0B;IAC3E,eAAe,EAAE,oBAAoB,EAAE,wBAAwB;IAC/D,qBAAqB,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB;IAC/E,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU;IAEzE,iBAAiB;IACjB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa;IACrF,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;IAExE,mBAAmB;IACnB,YAAY,EAAE,mBAAmB,EAAE,eAAe;IAElD,oBAAoB;IACpB,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY;IACvE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe;IAEnE,4BAA4B;IAC5B,kBAAkB,EAAE,WAAW,EAAE,YAAY;IAE7C,qCAAqC;IACrC,oBAAoB,EAAE,WAAW;IAEjC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU;IAEzC,oCAAoC;IACpC,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,gCAAgC;IACzF,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM;IAE9C,UAAU;IACV,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc;IAC7E,kBAAkB,EAAE,eAAe,EAAE,eAAe;IAEpD,yEAAyE;IACzE,6EAA6E;IAC7E,oDAAoD;IACpD,OAAO;IACP,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW;IAC/E,YAAY,EAAE,iEAAiE;IAC/E,4CAA4C;IAC5C,QAAQ,EAAE,QAAQ;IAClB,KAAK;IACL,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IAC1D,SAAS;IACT,KAAK,EAAE,OAAO,EAAE,MAAM;CACvB,CAAC,CAAC;AAEH,gFAAgF;AAChF,yBAAyB;AACzB,+FAA+F;AAC/F,gFAAgF;AAEhF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,uCAAuC;IACvC,QAAQ,EAAY,sBAAsB;IAC1C,oBAAoB;IACpB,WAAW;IAEX,6CAA6C;IAC7C,cAAc;IACd,QAAQ,EAAY,+BAA+B;IAEnD,2CAA2C;IAC3C,cAAc,EAAE,eAAe,EAAE,eAAe;IAChD,aAAa;IACb,oBAAoB;IACpB,cAAc;IACd,cAAc;IAEd,6EAA6E;IAC7E,oEAAoE;IACpE,2EAA2E;IAC3E,wCAAwC;IACxC,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;IAErB,mBAAmB;IACnB,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,gFAAgF;AAChF,qBAAqB;AACrB,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACxC,yBAAyB;IACzB,KAAK,EAAa,qCAAqC;IACvD,IAAI,EAAc,wBAAwB;IAC1C,SAAS,EAAS,sBAAsB;IACxC,gBAAgB,EAAE,6BAA6B;IAC/C,YAAY,EAAM,yBAAyB;IAE3C,UAAU;IACV,QAAQ,EAAU,qBAAqB;IACvC,OAAO,EAAW,eAAe;IACjC,OAAO,EAAW,cAAc;IAChC,QAAQ,EAAU,8BAA8B;IAEhD,mBAAmB;IACnB,SAAS,EAAS,oBAAoB;IACtC,QAAQ,EAAU,qBAAqB;IACvC,MAAM,EAAY,mBAAmB;IACrC,QAAQ,EAAU,uBAAuB;IAEzC,mBAAmB;IACnB,gBAAgB,EAAE,8BAA8B;IAEhD,8EAA8E;IAC9E,kFAAkF;IAClF,8EAA8E;IAC9E,+EAA+E;IAC/E,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/patterns.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,6BAA6B;IAC7B,sBAAsB;IACtB,mBAAmB;IACnB,oBAAoB;IACpB,oBAAoB;IACpB,wBAAwB;IACxB,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,mBAAmB;IACnB,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,cAAc;IACd,YAAY,EAAG,oBAAoB;IACnC,cAAc;IACd,aAAa;IAEb,0DAA0D;IAC1D,sBAAsB;IACtB,oBAAoB;IACpB,eAAe;IAEf,cAAc;IACd,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;IACrB,eAAe;IAEf,kBAAkB;IAClB,wBAAwB;IACxB,cAAc;IAEd,mBAAmB;IACnB,aAAa;IACb,aAAa;IAEb,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IAErB,mCAAmC;IACnC,eAAe;IACf,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,cAAc;IACd,sBAAsB;IACtB,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,uBAAuB;IACvB,yBAAyB;CAC1B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5E,CAAC;AAEF,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,QAAQ;IACR,eAAe,EAAE,wBAAwB,EAAE,qBAAqB;IAChE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,uBAAuB;IACvE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc;IAChE,aAAa,EAAE,iBAAiB,EAAE,cAAc;IAEhD,qBAAqB;IACrB,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,0BAA0B;IAC3E,eAAe,EAAE,oBAAoB,EAAE,wBAAwB;IAC/D,qBAAqB,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB;IAC/E,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU;IAEzE,iBAAiB;IACjB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa;IACrF,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW;IAExE,mBAAmB;IACnB,YAAY,EAAE,mBAAmB,EAAE,eAAe;IAElD,oBAAoB;IACpB,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY;IACvE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe;IAEnE,4BAA4B;IAC5B,kBAAkB,EAAE,WAAW,EAAE,YAAY;IAE7C,qCAAqC;IACrC,oBAAoB,EAAE,WAAW;IAEjC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU;IAEzC,oCAAoC;IACpC,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,gCAAgC;IACzF,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM;IAE9C,UAAU;IACV,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc;IAC7E,kBAAkB,EAAE,eAAe,EAAE,eAAe;IAEpD,yEAAyE;IACzE,6EAA6E;IAC7E,oDAAoD;IACpD,OAAO;IACP,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW;IAC/E,YAAY,EAAE,iEAAiE;IAC/E,4CAA4C;IAC5C,QAAQ,EAAE,QAAQ;IAClB,KAAK;IACL,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IAC1D,SAAS;IACT,KAAK,EAAE,OAAO,EAAE,MAAM;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,QAAQ;IACR,eAAe,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,cAAc;IAChF,cAAc,EAAE,uBAAuB;IACvC,qBAAqB;IACrB,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,0BAA0B;IAC3E,eAAe,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,qBAAqB;IACtF,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe;IACzE,eAAe,EAAE,UAAU;IAC3B,mCAAmC;IACnC,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa;IACrF,kBAAkB;IAClB,mBAAmB;IACnB,YAAY,EAAE,mBAAmB,EAAE,eAAe;CACnD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAwB,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAErG,gFAAgF;AAChF,yBAAyB;AACzB,+FAA+F;AAC/F,gFAAgF;AAEhF,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,uCAAuC;IACvC,QAAQ,EAAY,sBAAsB;IAC1C,oBAAoB;IACpB,WAAW;IAEX,6CAA6C;IAC7C,cAAc;IACd,QAAQ,EAAY,+BAA+B;IAEnD,2CAA2C;IAC3C,cAAc,EAAE,eAAe,EAAE,eAAe;IAChD,aAAa;IACb,oBAAoB;IACpB,cAAc;IACd,cAAc;IAEd,6EAA6E;IAC7E,oEAAoE;IACpE,2EAA2E;IAC3E,wCAAwC;IACxC,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;IAErB,mBAAmB;IACnB,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAEH,gFAAgF;AAChF,qBAAqB;AACrB,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACxC,yBAAyB;IACzB,KAAK,EAAa,qCAAqC;IACvD,IAAI,EAAc,wBAAwB;IAC1C,SAAS,EAAS,sBAAsB;IACxC,gBAAgB,EAAE,6BAA6B;IAC/C,YAAY,EAAM,yBAAyB;IAE3C,UAAU;IACV,QAAQ,EAAU,qBAAqB;IACvC,OAAO,EAAW,eAAe;IACjC,OAAO,EAAW,cAAc;IAChC,QAAQ,EAAU,8BAA8B;IAEhD,mBAAmB;IACnB,SAAS,EAAS,oBAAoB;IACtC,QAAQ,EAAU,qBAAqB;IACvC,MAAM,EAAY,mBAAmB;IACrC,QAAQ,EAAU,uBAAuB;IAEzC,mBAAmB;IACnB,gBAAgB,EAAE,8BAA8B;IAEhD,8EAA8E;IAC9E,kFAAkF;IAClF,8EAA8E;IAC9E,+EAA+E;IAC/E,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;CACtB,CAAC,CAAC"}
|
|
@@ -21,14 +21,29 @@ export declare class ConstantPropagator {
|
|
|
21
21
|
private unreachableLines;
|
|
22
22
|
private taintedCollections;
|
|
23
23
|
private sanitizedVars;
|
|
24
|
+
/** #589: per sanitized variable, the sink types its context-specific encoder does NOT clean. */
|
|
25
|
+
private sanitizedVarUncovered;
|
|
24
26
|
private source;
|
|
25
27
|
private evaluator;
|
|
26
28
|
private definitionNodes;
|
|
27
29
|
private inConditionalBranch;
|
|
28
30
|
private methodReturnsConstant;
|
|
29
31
|
private methodReturnsSanitized;
|
|
32
|
+
/** #581: same-file helpers named like a class-less sanitizer but not actually sanitizing. */
|
|
33
|
+
private localNonSanitizing;
|
|
34
|
+
/**
|
|
35
|
+
* #589: same-file helpers whose every reachable return is a direct call to a
|
|
36
|
+
* context-specific HTML encoder (`return StringEscapeUtils.escapeHtml(v);`).
|
|
37
|
+
* Such a helper cleans `xss` like the encoder it wraps, but not `trust_boundary`.
|
|
38
|
+
*/
|
|
39
|
+
private methodReturnsHtmlEncoderOnly;
|
|
40
|
+
private methodNotHtmlEncoderOnly;
|
|
30
41
|
private methodReturnsParameter;
|
|
31
42
|
private methodReturnsSafeValue;
|
|
43
|
+
/** Go locals (method-scoped) that were ever assigned a value const-prop cannot prove clean (#751). */
|
|
44
|
+
private goUnknownVars;
|
|
45
|
+
/** Every method-scoped name handleGoAssignment wrote; these get no unscoped alias in the result. */
|
|
46
|
+
private goScopedNames;
|
|
32
47
|
private additionalTaintPatterns;
|
|
33
48
|
private listElements;
|
|
34
49
|
private loopVariables;
|
|
@@ -74,6 +89,8 @@ export declare class ConstantPropagator {
|
|
|
74
89
|
private analyzeMethodReturns;
|
|
75
90
|
private findParameterSource;
|
|
76
91
|
private extractSourceVariable;
|
|
92
|
+
/** Return the expression node from a `return_statement` (Java, Go, Python, …). */
|
|
93
|
+
private returnExpressionValueNode;
|
|
77
94
|
private getMethodParameters;
|
|
78
95
|
private isSanitizerCall;
|
|
79
96
|
private variableIsAssignedFromSanitizer;
|
|
@@ -161,6 +178,15 @@ export declare class ConstantPropagator {
|
|
|
161
178
|
private lookupSymbol;
|
|
162
179
|
private handleLoopStatement;
|
|
163
180
|
private collectLoopVariableNames;
|
|
181
|
+
/**
|
|
182
|
+
* cognium-dev#753 — try/catch must not let a catch-arm literal assignment
|
|
183
|
+
* erase taint established on the normal-completion path through the try body
|
|
184
|
+
* (`try { label = format(picked); } catch (…) { label = ""; }` then
|
|
185
|
+
* `exec(tool + label)`).
|
|
186
|
+
*/
|
|
187
|
+
private handleTryStatement;
|
|
188
|
+
/** Prefer unknown / non-literal over a definite literal when paths disagree. */
|
|
189
|
+
private mergeTryCatchSymbol;
|
|
164
190
|
/**
|
|
165
191
|
* Handle synchronized statements.
|
|
166
192
|
* Operations inside synchronized blocks are atomic, so field strong updates are safe.
|
|
@@ -172,8 +198,33 @@ export declare class ConstantPropagator {
|
|
|
172
198
|
private collectSynchronizedLines;
|
|
173
199
|
private markLoopVariables;
|
|
174
200
|
private handleVariableDeclaration;
|
|
201
|
+
/**
|
|
202
|
+
* Go `:=` / `=` (cognium-dev#751).
|
|
203
|
+
*
|
|
204
|
+
* Const-prop does not model Go request sources, so a right-hand side it does
|
|
205
|
+
* not see as tainted is usually just *unknown* (`r.URL.Query().Get("f")`,
|
|
206
|
+
* `"SELECT " + f`, `r.FormValue("x")`). Recording such a variable as a clean
|
|
207
|
+
* symbol makes the const-prop veto drop real flows downstream, so only a
|
|
208
|
+
* right-hand side that is provably clean — a constant, or a call to a local
|
|
209
|
+
* helper that always returns a constant — clears the variable. Anything else stops being tracked here, which is what Go
|
|
210
|
+
* assignments got before this handler existed: the DFG decides.
|
|
211
|
+
*/
|
|
212
|
+
private handleGoAssignment;
|
|
213
|
+
/**
|
|
214
|
+
* A Go right-hand side whose value is clean regardless of its inputs: a
|
|
215
|
+
* compile-time constant, or a call to a local helper whose every reachable
|
|
216
|
+
* return is a constant (#751). Sanitizer-style calls are deliberately not
|
|
217
|
+
* included: clearing here vetoes every sink type, and Go sanitizers are
|
|
218
|
+
* sink-specific (`strconv.Atoi` bounds nothing for a `make` size, #349).
|
|
219
|
+
*/
|
|
220
|
+
private isGoKnownCleanRhs;
|
|
175
221
|
private handleAssignment;
|
|
176
222
|
private handleArrayElementAssignment;
|
|
223
|
+
/** cognium-dev#476: `grid[0][0]` and deeper element paths. */
|
|
224
|
+
private parseArrayAccessChain;
|
|
225
|
+
private arrayElementStorageKey;
|
|
226
|
+
private setArrayElementTaint;
|
|
227
|
+
private isArrayElementAccessTainted;
|
|
177
228
|
private handleUpdateExpression;
|
|
178
229
|
private handleIfStatement;
|
|
179
230
|
/**
|
|
@@ -213,6 +264,12 @@ export declare class ConstantPropagator {
|
|
|
213
264
|
* Handles Java (`method_invocation`), Go/JS/TS (`call_expression`), and
|
|
214
265
|
* Python (`call`) AST shapes.
|
|
215
266
|
*/
|
|
267
|
+
/**
|
|
268
|
+
* #589: remember which sink types the sanitizer behind `scopedName` does NOT
|
|
269
|
+
* clean. Only context-specific HTML/markup encoders carry an entry; any other
|
|
270
|
+
* sanitizer clears a previously recorded one (the variable was reassigned).
|
|
271
|
+
*/
|
|
272
|
+
private recordSanitizerScope;
|
|
216
273
|
isSanitizerMethodCall(node: Node): boolean;
|
|
217
274
|
/**
|
|
218
275
|
* Extract the trailing method/function name from any call node shape:
|
|
@@ -254,6 +311,8 @@ export declare class ConstantPropagator {
|
|
|
254
311
|
isTaintedExpression(node: Node): boolean;
|
|
255
312
|
private isTaintedExpressionImpl;
|
|
256
313
|
private isTaintedExpressionStep;
|
|
314
|
+
/** cognium-dev#476: copy tainted array element indices across `System.arraycopy`. */
|
|
315
|
+
private handleSystemArrayCopy;
|
|
257
316
|
private checkCollectionTaint;
|
|
258
317
|
}
|
|
259
318
|
//# sourceMappingURL=propagator.d.ts.map
|