circle-ir 4.16.0 → 4.16.1

package/dist/analysis/passes/taint-propagation-pass.js

@@ -369,25 +369,44 @@ function resolveJavaDerivedAnchor(varName, derived, realSourceByVar, codeLines,
  * const-prop never seeds those derived names. Argument-style derivations
  * (`shown = encodeForPage(nick)`) must keep the veto so sanitizer credit holds.
  */
-function javaReceiverChainDerivedVar(code, localVar, seedVar) {
+function javaReceiverChainDerivedVar(rhsByLocal, localVar, seedVar) {
     if (!seedVar || localVar === seedVar)
         return false;
+    const rhsList = rhsByLocal.get(localVar);
+    if (!rhsList)
+        return false;
     const esc = seedVar.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     const receiverOnRhs = new RegExp(`(?:^|[^\\w.$])${esc}\\s*\\.`, 'u');
+    return rhsList.some(rhs => receiverOnRhs.test(rhs));
+}
+/**
+ * cognium-dev#806 — the assignment RHS texts of each Java local, indexed once
+ * per file. `javaReceiverChainDerivedVar` used to re-run its declaration regex
+ * over every line for every (source, derived local) pair, which made large
+ * files take seconds. Same per-line matching, done once.
+ */
+function indexJavaLocalAssignments(code) {
     const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
     const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+    const index = new Map();
     for (const line of code.split('\n')) {
         const trimmed = line.trimStart();
         if (trimmed.startsWith('//') || trimmed.startsWith('*'))
             continue;
+        // Cheap pre-check: neither regex can match a line without `=` and `;`.
+        if (!line.includes('=') || !line.includes(';'))
+            continue;
         const m = declRe.exec(line) ?? assignRe.exec(line);
-        if (!m || m[1] !== localVar)
+        if (!m)
             continue;
+        const list = index.get(m[1]);
         const rhs = stripJavaTrailingComment(m[2]);
-        if (receiverOnRhs.test(rhs))
-            return true;
+        if (list)
+            list.push(rhs);
+        else
+            index.set(m[1], [rhs]);
     }
-    return false;
+    return index;
 }
 function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
     const lines = typeof code === 'string' ? code.split('\n') : [];
@@ -553,16 +572,24 @@ export class TaintPropagationPass {
         // into const-prop's tainted set so DFG + expression-scan vetoes keep them.
         // Per-source seeding + receiver filter avoids argument-style derivations
         // (`shown = encodeForPage(nick)`) that must stay vetoed for sanitizer credit.
+        // cognium-dev#806: index the assignments once, visit each seed name once,
+        // and skip the file-wide derivation when no local not already tainted has
+        // a `seed.` receiver on its RHS (only such locals can be added).
         if (ctx.language === 'java' && typeof ctx.code === 'string') {
+            const rhsByLocal = indexJavaLocalAssignments(ctx.code);
+            const seen = new Set();
             for (const s of sources) {
-                if (!s.variable)
+                if (!s.variable || seen.has(s.variable))
                     continue;
-                for (const [v] of buildJavaTaintedVars(ctx.code, new Set([s.variable]))) {
-                    if (v === s.variable)
-                        continue;
-                    if (javaReceiverChainDerivedVar(ctx.code, v, s.variable)) {
+                seen.add(s.variable);
+                const seedVar = s.variable;
+                const candidates = [...rhsByLocal.keys()].filter(v => !constProp.tainted.has(v) && javaReceiverChainDerivedVar(rhsByLocal, v, seedVar));
+                if (candidates.length === 0)
+                    continue;
+                const derived = buildJavaTaintedVars(ctx.code, new Set([seedVar]));
+                for (const v of candidates) {
+                    if (derived.has(v))
                         constProp.tainted.add(v);
-                    }
                 }
             }
         }