circle-ir 4.16.0 → 4.17.0

package/dist/browser/circle-ir.js

@@ -4663,14 +4663,43 @@ function extractJavaTypes(tree, cache, options) {
     );
     const path = node ? enclosingTypePath(node) : [];
     if (path.length > 0) t.enclosing_type = path.join(".");
-    const params = node?.childForFieldName("type_parameters");
-    if (params) {
-      const names = params.namedChildren.filter((c) => c?.type === "type_parameter").map((c) => c.namedChildren.find((x) => x?.type === "type_identifier" || x?.type === "identifier")).map((x) => x ? getNodeText(x) : "").filter(Boolean);
-      if (names.length > 0) t.type_parameters = names;
+    const tp = typeParameters(node);
+    if (tp.names.length > 0) t.type_parameters = tp.names;
+    if (Object.keys(tp.bounds).length > 0) t.type_parameter_bounds = tp.bounds;
+  }
+  const allMethods = /* @__PURE__ */ new Map();
+  for (const t of types) {
+    for (const m of t.methods) allMethods.set(`${m.start_line}:${m.name}`, m);
+  }
+  for (const kind of ["method_declaration", "constructor_declaration"]) {
+    for (const node of getNodesFromCache(tree.rootNode, kind, cache)) {
+      const name2 = getIdentifier(node, "name");
+      const info2 = name2 ? allMethods.get(`${node.startPosition.row + 1}:${name2}`) : void 0;
+      if (!info2) continue;
+      const tp = typeParameters(node);
+      if (tp.names.length > 0) info2.type_parameters = tp.names;
+      if (Object.keys(tp.bounds).length > 0) info2.type_parameter_bounds = tp.bounds;
     }
   }
   return types;
 }
+function typeParameters(node) {
+  const names = [];
+  const bounds = {};
+  const list = node ? node.childForFieldName("type_parameters") ?? node.namedChildren.find((c) => c?.type === "type_parameters") ?? null : null;
+  if (!list) return { names, bounds };
+  for (const c of list.namedChildren) {
+    if (c?.type !== "type_parameter") continue;
+    const id = c.namedChildren.find((x) => x?.type === "type_identifier" || x?.type === "identifier");
+    const name2 = id ? getNodeText(id) : "";
+    if (!name2) continue;
+    names.push(name2);
+    const bound = c.namedChildren.find((x) => x?.type === "type_bound");
+    const first = bound?.namedChildren.find((x) => x !== null && x.type !== "annotation" && x.type !== "marker_annotation");
+    if (first) bounds[name2] = getNodeText(first);
+  }
+  return { names, bounds };
+}
 function recordComponents(node) {
   const out2 = [];
   const params = node.childForFieldName("parameters");
@@ -16735,6 +16764,85 @@ function passesMutParam(line, n) {
   if (!new RegExp(String.raw`(?<![\w.])(?:[A-Za-z_]\w*(?:\s*::\s*[A-Za-z_]\w*)*)\s*\((?:[^)]*,\s*)?${n}\b`).test(line)) return false;
   return !new RegExp(String.raw`\b${n}\s*\.\s*\w+\s*\(`).test(line) || new RegExp(String.raw`(?<![\w.])\w+\s*\(\s*${n}\b`).test(line);
 }
+function findRustAllowlistTernarySanitizers(code) {
+  const masked = maskRust(code);
+  const origLines = code.split("\n");
+  const maskedLines = masked.split("\n");
+  const out2 = [];
+  const allowlistVar = (cond) => {
+    const c = cond.trim();
+    let m = new RegExp(String.raw`^!?(\w+)\s*\.\s*contains\s*\(\s*&\s*(\w+)(?:\s*\.\s*as_str\s*\(\s*\))?\s*\)$`).exec(c);
+    if (m) return m[2];
+    if (m = new RegExp(String.raw`^!\s*\[\s*${STR}(?:\s*,\s*${STR})*\s*,?\s*\]\s*\.\s*contains\s*\(\s*&\s*${VAR}\s*\)$`).exec(c)) {
+      return m[1];
+    }
+    return guardedVariable(c);
+  };
+  const LITERAL_CHAIN = /* @__PURE__ */ new Set(["to_string", "into", "to_owned", "clone"]);
+  const literalOnly = (block) => {
+    const maskedB = maskRust(block.trim());
+    if (!maskedB.trim()) return false;
+    const re = /[A-Za-z_]\w*/g;
+    let m;
+    while ((m = re.exec(maskedB)) !== null) {
+      const id = m[0];
+      if (KEYWORDS.has(id) || /[A-Z]/.test(id[0]) || LITERAL_CHAIN.has(id)) continue;
+      return false;
+    }
+    return true;
+  };
+  const usesOnlyVar = (block, name2) => {
+    const b = block.trim();
+    if (!b) return false;
+    const maskedB = maskRust(b);
+    const re = new RegExp(String.raw`(?<![\w.])${name2}\b`);
+    if (!re.test(maskedB)) return false;
+    return !readsOtherValue(b, maskedB, name2);
+  };
+  for (const m of masked.matchAll(/\blet\s+(\w+)\s*=\s*if\b/g)) {
+    const bound = m[1];
+    const at = m.index + m[0].length - 2;
+    let depth = 0;
+    let open = -1;
+    for (let i2 = at + 2; i2 < masked.length; i2++) {
+      const ch = masked[i2];
+      if (ch === "(" || ch === "[") depth++;
+      else if (ch === ")" || ch === "]") depth--;
+      else if (ch === "{" && depth === 0) {
+        open = i2;
+        break;
+      } else if (ch === ";" || ch === "}") break;
+    }
+    if (open < 0) continue;
+    const cond = code.slice(at + 2, open).trim();
+    const guarded = allowlistVar(cond);
+    if (!guarded) continue;
+    const thenClose = matchBrace(masked, open);
+    if (thenClose < 0) continue;
+    const thenBody = code.slice(open + 1, thenClose);
+    if (!/^\s*else\b/.test(masked.slice(thenClose + 1, thenClose + 10))) continue;
+    const elseOpen = masked.indexOf("{", thenClose + 1);
+    if (elseOpen < 0) continue;
+    const elseClose = matchBrace(masked, elseOpen);
+    if (elseClose < 0) continue;
+    const elseBody = code.slice(elseOpen + 1, elseClose);
+    const inverted = /^\s*!/.test(cond);
+    const ok = inverted ? literalOnly(thenBody) && usesOnlyVar(elseBody, guarded) : usesOnlyVar(thenBody, guarded) && literalOnly(elseBody);
+    if (!ok) continue;
+    const assignLine = masked.slice(0, at).split("\n").length;
+    const mention = new RegExp(String.raw`(?<![\w.])${bound}\b`);
+    for (let l = assignLine; l < origLines.length; l++) {
+      if (!mention.test(maskedLines[l])) continue;
+      out2.push({
+        type: "rust_allowlist_ternary",
+        method: "guard",
+        line: l + 1,
+        sanitizes: CREDITED_TYPES
+      });
+    }
+  }
+  return out2;
+}
 function findRustLiteralEqualityGuardSanitizers(code) {
   const masked = maskRust(code);
   const origLines = code.split("\n");
@@ -16855,7 +16963,7 @@ function findRustLiteralEqualityGuardSanitizers(code) {
       });
     }
   }
-  return out2;
+  return [...out2, ...findRustAllowlistTernarySanitizers(code)];
 }
 function statementSpan(code, masked, lineStart, endIdx) {
   let start2 = lineStart;
@@ -18233,6 +18341,7 @@ function findCSharpRequestSources(sourceCode, language) {
   const assignRe = /^\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const arrayElementAssignRe = /^\s*([A-Za-z_]\w*)\s*\[[^\]]+\]\s*=\s*(.+?);?\s*$/;
   const memberFieldAssignRe = /^\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+  const collectionAddRe = /^\s*([A-Za-z_]\w*)\s*\.\s*Add\s*\(\s*(.+?)\s*\)\s*;?\s*$/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
   const formFileParams = /* @__PURE__ */ new Set();
@@ -18326,6 +18435,25 @@ function findCSharpRequestSources(sourceCode, language) {
           continue;
         }
       }
+      const addEl = collectionAddRe.exec(stmt);
+      if (addEl) {
+        const [, baseName, rhs2] = addEl;
+        const type2 = classify(rhs2);
+        if (type2 && baseName) {
+          const lineNumber2 = i2 + 1;
+          if (!sources.some((s) => s.line === lineNumber2 && s.variable === baseName)) {
+            sources.push({
+              type: type2,
+              location: `${baseName}.Add(${rhs2.trim().substring(0, 50)}${rhs2.length > 50 ? "..." : ""})`,
+              severity: type2 === "db_input" ? "medium" : "high",
+              line: lineNumber2,
+              confidence: 1,
+              variable: baseName
+            });
+          }
+          continue;
+        }
+      }
       const m = assignRe.exec(stmt);
       const rhsCrossesBlock = m !== null && m[2].includes("{");
       if (!m || rhsCrossesBlock) {
@@ -21865,14 +21993,17 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
   const sanitizers = [];
   const lines = code.split("\n");
   const terminatorRe = /\b(throw|return)\b/;
+  const literalArrays = collectCSharpLiteralArrayFields(code);
+  const indexOfRe = /\bif\s*\(\s*(?:System\s*\.\s*)?Array\s*\.\s*IndexOf\s*\(\s*([A-Za-z_]\w*)\s*,\s*([A-Za-z_][\w.]*)\s*\)\s*(?:<\s*0|==\s*-\s*1)\s*\)/;
   const allowlistRes = [
-    /\bif\s*\(\s*Array\s*\.\s*IndexOf\s*\([^,]+,\s*([A-Za-z_][\w.]*)\s*\)\s*<\s*0\s*\)/,
     /\bif\s*\(\s*!\s*[A-Za-z_][\w.]*\s*\.\s*Contains\s*\(\s*([A-Za-z_][\w.]*)\s*\)\s*\)/
   ];
   const charClassRe = /\bif\s*\(\s*!\s*([A-Za-z_][\w.]*)\s*\.\s*All\s*\(\s*char\s*\.\s*Is[A-Za-z]+\s*\)\s*\)/;
   for (let i2 = 0; i2 < lines.length; i2++) {
     let guardedExpr = null;
-    for (const re of allowlistRes) {
+    const im = indexOfRe.exec(lines[i2]);
+    if (im && literalArrays.has(im[1])) guardedExpr = im[2];
+    if (!guardedExpr) for (const re of allowlistRes) {
       const m = re.exec(lines[i2]);
       if (m) {
         guardedExpr = m[1];
@@ -21900,6 +22031,7 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
     for (let l = i2 + 1; l < lines.length; l++) {
       const a = assignRe.exec(lines[l]);
       if (a && mentions2(a[2])) guarded.add(a[1]);
+      else if (a) guarded.delete(a[1]);
       if (mentions2(lines[l])) {
         sanitizers.push({
           type: "csharp_early_return_guard",
@@ -21920,6 +22052,25 @@ function findCSharpEarlyReturnGuardSanitizers(code, language) {
   }
   return sanitizers;
 }
+function collectCSharpLiteralArrayFields(code) {
+  const names = /* @__PURE__ */ new Set();
+  const lit = String.raw`(?:@"(?:[^"]|"")*"|"(?:[^"\\\n]|\\.)*")`;
+  const elems = new RegExp(String.raw`^\s*${lit}(?:\s*,\s*${lit})*\s*,?\s*$`);
+  const declRe = /((?:\b(?:public|private|protected|internal|static|readonly)\s+)+)string\s*\[\s*\]\s+([A-Za-z_]\w*)\s*=\s*(?:new\s+(?:string\s*)?\[\s*\]\s*)?\{([^{}]*)\}\s*;/g;
+  for (const m of code.matchAll(declRe)) {
+    const mods = m[1];
+    const name2 = m[2];
+    if (!/\bstatic\b/.test(mods) || !/\breadonly\b/.test(mods)) continue;
+    if (!elems.test(m[3])) continue;
+    const rest = code.slice(0, m.index) + code.slice(m.index + m[0].length);
+    const written = new RegExp(
+      String.raw`\b${name2}\s*(?:\[[^\]]*\]\s*)?(?:[-+*/%&|^]|\?\?)?=(?!=)` + String.raw`|\b(?:ref|out)\s+${name2}\b` + String.raw`|\b${name2}\s*\.\s*SetValue\s*\(` + String.raw`|\bArray\s*\.\s*(?:Clear|Copy|ConstrainedCopy|Fill|Resize|Reverse|Sort)\s*\([^;]*\b${name2}\b`
+    );
+    if (written.test(rest)) continue;
+    names.add(name2);
+  }
+  return names;
+}
 function findCSharpFullPathStartsWithGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -26381,6 +26532,9 @@ function isInterproceduralTaintableType(typeName, language) {
       "IEnumerable",
       "ICollection",
       "IList",
+      "List",
+      "Hashtable",
+      "ArrayList",
       "Dictionary",
       "IDictionary",
       "IReadOnlyList",
@@ -30968,10 +31122,12 @@ function isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls) {
     if (other === call || other.method_name === "format") continue;
     if (other.arguments.some((a) => a.expression.includes(needle))) return false;
   }
-  const receiver = call.receiver;
+  return isJdkClassReceiver(call.receiver, JAVA_FORMATTER_CLASSES, declaredTypeNames, imports);
+}
+function isJdkClassReceiver(receiver, classes, declaredTypeNames, imports) {
   const dot = receiver.lastIndexOf(".");
   const simple = dot < 0 ? receiver : receiver.slice(dot + 1);
-  const pkg = JAVA_FORMATTER_CLASSES.get(simple);
+  const pkg = classes.get(simple);
   if (pkg === void 0) return false;
   if (dot >= 0) return receiver === `${pkg}.${simple}`;
   if (declaredTypeNames.has(simple)) return false;
@@ -30982,8 +31138,41 @@ function isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls) {
   if (pkg === "java.lang") return true;
   return imports.some((imp) => imp.from_package === pkg && (imp.imported_name === simple || imp.is_wildcard));
 }
+var JAVA_CHARACTER_CLASS = /* @__PURE__ */ new Map([["Character", "java.lang"]]);
+var JAVA_CHARACTER_PREDICATES = /* @__PURE__ */ new Set([
+  "isLetter",
+  "isDigit",
+  "isLetterOrDigit",
+  "isAlphabetic",
+  "isWhitespace",
+  "isSpaceChar",
+  "isUpperCase",
+  "isLowerCase",
+  "isTitleCase",
+  "isISOControl",
+  "isDefined",
+  "isIdeographic",
+  "isMirrored",
+  "isJavaIdentifierStart",
+  "isJavaIdentifierPart",
+  "isUnicodeIdentifierStart",
+  "isUnicodeIdentifierPart",
+  "isIdentifierIgnorable",
+  "isHighSurrogate",
+  "isLowSurrogate",
+  "isSurrogate",
+  "isSurrogatePair",
+  "isValidCodePoint",
+  "isBmpCodePoint",
+  "isSupplementaryCodePoint"
+]);
+function isJavaCharacterPredicateCall(call, declaredTypeNames, imports) {
+  if (!call.receiver || !JAVA_CHARACTER_PREDICATES.has(call.method_name)) return false;
+  return isJdkClassReceiver(call.receiver, JAVA_CHARACTER_CLASS, declaredTypeNames, imports);
+}
 function isJavaNonEscapeCall(call, declaredTypeNames, imports, calls) {
   if (isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls)) return true;
+  if (isJavaCharacterPredicateCall(call, declaredTypeNames, imports)) return true;
   if (call.receiver) return false;
   const isCtor = call.is_constructor === true || (call.resolution?.target ?? "").endsWith(".<init>");
   if (!isCtor) return false;
@@ -31969,6 +32158,11 @@ var ConstantPropagator = class _ConstantPropagator {
   taintedArrayElements = /* @__PURE__ */ new Map();
   // Track current method name for scoping local variables
   currentMethod = null;
+  /** Start lines of nested `{ ... }` blocks — disambiguate same-named locals (#476 Collections10). */
+  blockScopeStack = [];
+  lineBlockScopes = /* @__PURE__ */ new Map();
+  /** Skip block-scope push on the method/constructor body `{ ... }` (#476). */
+  skipMethodBodyBlockScope = false;
   // Track conditional taints: which variables were tainted under which conditions
   // Maps condition expression string → set of variables tainted under that condition
   conditionalTaints = /* @__PURE__ */ new Map();
@@ -31982,6 +32176,8 @@ var ConstantPropagator = class _ConstantPropagator {
   inSynchronizedBlock = false;
   // Track iterator sources: iterator variable name → collection name it was created from
   iteratorSources = /* @__PURE__ */ new Map();
+  /** Vars assigned from `iter.next()` — do not retro-clear on later iterator rebind (#476). */
+  taintedFromIteratorNext = /* @__PURE__ */ new Set();
   // Track class field names (declared at class level, not local variables)
   classFields = /* @__PURE__ */ new Set();
   // Track tainted method parameters for inter-procedural analysis
@@ -32039,12 +32235,16 @@ var ConstantPropagator = class _ConstantPropagator {
     this.sanitizedVars.clear();
     this.sanitizedVarUncovered.clear();
     this.currentMethod = null;
+    this.blockScopeStack = [];
+    this.lineBlockScopes.clear();
+    this.skipMethodBodyBlockScope = false;
     this.conditionalTaints.clear();
     this.conditionStack = [];
     this.lineConditions.clear();
     this.synchronizedLines.clear();
     this.inSynchronizedBlock = false;
     this.iteratorSources.clear();
+    this.taintedFromIteratorNext.clear();
     this.classFields.clear();
     this.instanceFieldTaint.clear();
     this.currentClassName = null;
@@ -32069,6 +32269,9 @@ var ConstantPropagator = class _ConstantPropagator {
     const resultSymbols = new Map(this.symbols);
     for (const name2 of this.tainted) {
       if (name2.includes(":")) {
+        if (/^[^:]+:b\d+:/.test(name2)) {
+          continue;
+        }
         const unscoped = name2.substring(name2.indexOf(":") + 1);
         resultTainted.add(unscoped);
       }
@@ -32083,6 +32286,9 @@ var ConstantPropagator = class _ConstantPropagator {
     for (const [name2, value] of this.symbols) {
       if (this.goScopedNames.has(name2)) continue;
       if (name2.includes(":")) {
+        if (/^[^:]+:b\d+:/.test(name2)) {
+          continue;
+        }
         const unscoped = name2.substring(name2.indexOf(":") + 1);
         if (!resultSymbols.has(unscoped)) {
           resultSymbols.set(unscoped, value);
@@ -32092,6 +32298,7 @@ var ConstantPropagator = class _ConstantPropagator {
     return {
       symbols: resultSymbols,
       tainted: resultTainted,
+      lineBlockScopes: new Map(this.lineBlockScopes),
       unreachableLines: new Set(this.unreachableLines),
       taintedCollections: new Map(this.taintedCollections),
       taintedArrayElements: new Map(this.taintedArrayElements),
@@ -32635,6 +32842,18 @@ var ConstantPropagator = class _ConstantPropagator {
   // ===========================================================================
   // Taint Refinement
   // ===========================================================================
+  /** True when `node` is `iter.next()` (possibly under a cast). */
+  isIteratorNextExpression(node) {
+    const text = getNodeText2(node, this.source);
+    if (/\.\s*next\s*\(/.test(text)) return true;
+    let current = node;
+    if (current.type === "cast_expression" || current.type === "parenthesized_expression") {
+      current = current.childForFieldName("operand") ?? current.childForFieldName("expression");
+    }
+    if (!current || current.type !== "method_invocation") return false;
+    const nameNode = current.childForFieldName("name");
+    return nameNode ? getNodeText2(nameNode, this.source) === "next" : false;
+  }
   refineTaintFromConstants() {
     let changed = true;
     let iterations = 0;
@@ -32644,6 +32863,9 @@ var ConstantPropagator = class _ConstantPropagator {
       iterations++;
       const toRemove = [];
       for (const varName of this.tainted) {
+        if (this.taintedFromIteratorNext.has(varName)) {
+          continue;
+        }
         const symbol = this.symbols.get(varName);
         if (symbol && symbol.type !== "unknown") {
           toRemove.push(varName);
@@ -32692,6 +32914,9 @@ var ConstantPropagator = class _ConstantPropagator {
     if (this.unreachableLines.has(line)) {
       return true;
     }
+    if (this.blockScopeStack.length > 0) {
+      this.lineBlockScopes.set(line, this.blockScopeStack[this.blockScopeStack.length - 1]);
+    }
     if (this.conditionStack.length > 0 && !this.lineConditions.has(line)) {
       this.lineConditions.set(line, this.conditionStack[this.conditionStack.length - 1]);
     }
@@ -32723,6 +32948,15 @@ var ConstantPropagator = class _ConstantPropagator {
       case "if_statement":
         this.handleIfStatement(node);
         return true;
+      case "block": {
+        if (this.skipMethodBodyBlockScope) {
+          this.skipMethodBodyBlockScope = false;
+        }
+        for (const child of node.children) {
+          this.visit(child);
+        }
+        return true;
+      }
       case "switch_expression":
       case "switch_statement":
         this.handleSwitch(node);
@@ -32808,7 +33042,9 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     const body2 = node.childForFieldName("body");
     if (body2) {
+      this.skipMethodBodyBlockScope = true;
       this.visit(body2);
+      this.skipMethodBodyBlockScope = false;
     }
     this.currentMethod = prevMethod;
     this.inConstructor = prevInConstructor;
@@ -32822,10 +33058,31 @@ var ConstantPropagator = class _ConstantPropagator {
     if (varName.includes(".") || varName.includes(":")) {
       return varName;
     }
+    const blockId = this.blockScopeStack.length > 0 ? this.blockScopeStack[this.blockScopeStack.length - 1] : void 0;
     if (this.currentMethod) {
-      return `${this.currentMethod}:${varName}`;
+      return blockId !== void 0 ? `${this.currentMethod}:b${blockId}:${varName}` : `${this.currentMethod}:${varName}`;
     }
-    return varName;
+    return blockId !== void 0 ? `b${blockId}:${varName}` : varName;
+  }
+  /** Innermost block → method → unscoped, for reads that may bind to an outer declaration. */
+  getScopedNameCandidates(varName) {
+    if (varName.includes(".") || varName.includes(":")) {
+      return [varName];
+    }
+    const out2 = [];
+    for (let i2 = this.blockScopeStack.length - 1; i2 >= 0; i2--) {
+      const blockId = this.blockScopeStack[i2];
+      if (this.currentMethod) {
+        out2.push(`${this.currentMethod}:b${blockId}:${varName}`);
+      } else {
+        out2.push(`b${blockId}:${varName}`);
+      }
+    }
+    if (this.currentMethod) {
+      out2.push(`${this.currentMethod}:${varName}`);
+    }
+    out2.push(varName);
+    return out2;
   }
   /**
    * Look up a variable value, checking both scoped and unscoped names.
@@ -32833,11 +33090,12 @@ var ConstantPropagator = class _ConstantPropagator {
    * either local (scoped) or global (unscoped, like class fields).
    */
   lookupSymbol(varName) {
-    if (this.currentMethod && !varName.includes(".") && !varName.includes(":")) {
-      const scopedName = `${this.currentMethod}:${varName}`;
-      const scopedValue = this.symbols.get(scopedName);
-      if (scopedValue) {
-        return scopedValue;
+    if (!varName.includes(".") && !varName.includes(":")) {
+      for (const scopedName of this.getScopedNameCandidates(varName)) {
+        const scopedValue = this.symbols.get(scopedName);
+        if (scopedValue) {
+          return scopedValue;
+        }
       }
     }
     return this.symbols.get(varName);
@@ -32889,8 +33147,22 @@ var ConstantPropagator = class _ConstantPropagator {
         this.trackIteratorsInNode(initNode);
       }
     }
-    for (const child of node.children) {
-      this.visit(child);
+    if (node.type === "while_statement" || node.type === "do_statement") {
+      const body2 = node.childForFieldName("body");
+      for (const child of node.children) {
+        if (child !== body2) this.visit(child);
+      }
+      if (body2?.type === "block") {
+        this.blockScopeStack.push(getNodeLine(body2));
+        this.visit(body2);
+        this.blockScopeStack.pop();
+      } else if (body2) {
+        this.visit(body2);
+      }
+    } else {
+      for (const child of node.children) {
+        this.visit(child);
+      }
     }
     for (const varName of loopVarNames) {
       this.symbols.set(varName, createUnknown(getNodeLine(node)));
@@ -33032,6 +33304,10 @@ var ConstantPropagator = class _ConstantPropagator {
               this.sanitizedVars.delete(scopedName);
               this.sanitizedVarUncovered.delete(scopedName);
               this.definitionNodes.set(scopedName, valueNode);
+              if (this.isIteratorNextExpression(valueNode)) {
+                this.taintedFromIteratorNext.add(scopedName);
+                this.taintedFromIteratorNext.add(varName);
+              }
               this.symbols.set(scopedName, createUnknown(line));
             } else {
               if (this.inConditionalBranch) {
@@ -33159,6 +33435,12 @@ var ConstantPropagator = class _ConstantPropagator {
       this.sanitizedVars.delete(scopedName);
       this.sanitizedVarUncovered.delete(scopedName);
       this.definitionNodes.set(scopedName, right);
+      if (this.isIteratorNextExpression(right)) {
+        this.taintedFromIteratorNext.add(scopedName);
+        if (!varName.includes(".")) {
+          this.taintedFromIteratorNext.add(varName);
+        }
+      }
       this.symbols.set(scopedName, createUnknown(line));
       if (this.inConstructor && varName.startsWith("this.")) {
         const fieldName = varName.substring(5);
@@ -34149,10 +34431,17 @@ var ConstantPropagator = class _ConstantPropagator {
       }
     }
     if (node.type === "identifier") {
-      const scopedName = this.currentMethod ? `${this.currentMethod}:${text}` : text;
-      const isTainted = this.tainted.has(scopedName) || this.tainted.has(text);
-      if (isTainted) {
-        if (this.isExcludedByCondition(scopedName) || this.isExcludedByCondition(text)) {
+      let isTainted = false;
+      let boundName = null;
+      for (const candidate of this.getScopedNameCandidates(text)) {
+        if (this.tainted.has(candidate)) {
+          isTainted = true;
+          boundName = candidate;
+          break;
+        }
+      }
+      if (isTainted && boundName) {
+        if (this.isExcludedByCondition(boundName) || this.isExcludedByCondition(text)) {
           return false;
         }
       }
@@ -34359,6 +34648,14 @@ function analyzeConstantPropagation(tree, sourceCode, options = {}) {
     options.taintedParameters ?? []
   );
 }
+function constPropScopedVar(method, varName, line, result) {
+  if (!method) return varName;
+  const blockId = result.lineBlockScopes?.get(line);
+  if (blockId !== void 0) {
+    return `${method}:b${blockId}:${varName}`;
+  }
+  return `${method}:${varName}`;
+}
 function isFalsePositive(result, sinkLine, taintedVar) {
   if (result.unreachableLines.has(sinkLine)) {
     return { isFalsePositive: true, reason: "sink_in_dead_code" };
@@ -38627,6 +38924,11 @@ function bareIdentifiers(text) {
   for (const m of stripped.matchAll(/\b([A-Za-z_]\w*)\b/g)) out2.push(m[1]);
   return out2;
 }
+function isLiteralValue(rhs) {
+  if (/\$"/.test(rhs)) return false;
+  const ids = bareIdentifiers(rhs);
+  return ids.every((id) => id === "null" || id === "true" || id === "false" || id === "default") || /^\s*(?:string|String)\s*\.\s*Empty\s*$/.test(rhs);
+}
 function insideParens(text, open) {
   let depth = 0;
   for (let i2 = open; i2 < text.length; i2++) {
@@ -38807,6 +39109,36 @@ var CSharpCredit = class {
   sanitizedVarsAt(type, sinkLine) {
     return this.sanitizedVarsIn(type, this.methodAt(sinkLine)?.start_line ?? 1, sinkLine, true);
   }
+  /**
+   * Class fields judged across every method that writes them (cognium-dev#808).
+   * A field is read in one method and written in others, so each write is
+   * judged in its own method with the same in-method credit as a local, and
+   * the field is safe for `type` only when every write is: `sanitized` holds
+   * the fields with at least one credited write and no uncredited one,
+   * `unsanitized` the fields with an uncredited write. A literal write
+   * (`_v = "";`, `_v = null;`) is neutral.
+   */
+  fieldWrites(type, fields) {
+    const credited = /* @__PURE__ */ new Set();
+    const unsanitized = /* @__PURE__ */ new Set();
+    for (const m of this.methods) {
+      const sanitized = /* @__PURE__ */ new Set();
+      for (const st of this.statements(m.start_line, m.end_line + 1)) {
+        if (this.methodAt(st.line) !== m) continue;
+        for (const op of this.creditOpsInStatement(st.text)) {
+          const lhs = op.lhs;
+          const keeps = op.kind === "append" ? sanitized.has(lhs) && this.rhsKeepsSanitizerCredit(type, op.rhs, sanitized, true, true) : this.rhsKeepsSanitizerCredit(type, op.rhs, sanitized, true, false);
+          if (keeps) sanitized.add(lhs);
+          else sanitized.delete(lhs);
+          if (!fields.has(lhs) || isLiteralValue(op.rhs)) continue;
+          if (keeps) credited.add(lhs);
+          else unsanitized.add(lhs);
+        }
+      }
+    }
+    for (const f of unsanitized) credited.delete(f);
+    return { sanitized: credited, unsanitized };
+  }
   /**
    * True when the sink on `sinkLine` also receives a tainted value that no
    * sanitizer covers. In `Write(HtmlEncode(a) + b)` the encoder covers `a`
@@ -41832,6 +42164,15 @@ var SinkFilterPass = class {
       const csFields = new Set(ctx.graph.ir.types.flatMap((t) => (t.fields ?? []).map((f) => f.name)));
       const credit = new CSharpCredit(ctx.code, ctx.graph.ir.types.flatMap((t) => t.methods));
       const csSeeds = mergedSources.flatMap((s) => s.variable ? [{ variable: s.variable, line: s.line }] : []);
+      const fieldWritesByType = /* @__PURE__ */ new Map();
+      const fieldWritesFor = (type) => {
+        let w = fieldWritesByType.get(type);
+        if (!w) {
+          w = credit.fieldWrites(type, csFields);
+          fieldWritesByType.set(type, w);
+        }
+        return w;
+      };
       const xxeHardened = /\bXmlResolver\s*=\s*null\b/.test(ctx.code) || /\bDtdProcessing\s*=\s*(?:DtdProcessing\s*\.\s*)?(?:Prohibit|Ignore)\b/.test(ctx.code);
       filtered = filtered.filter((sink) => {
         if (sink.type === "xxe" && xxeHardened) return false;
@@ -41841,9 +42182,13 @@ var SinkFilterPass = class {
         const scoped = credit.sanitizedVarsAt(sink.type, sink.line);
         const fileWide = sanitizedByType.get(sink.type);
         const sanitizedVars = new Set(scoped);
+        const fieldWrites = fieldWritesFor(sink.type);
         if (fileWide) {
-          for (const v of fileWide) if (csFields.has(v)) sanitizedVars.add(v);
+          for (const v of fileWide) {
+            if (csFields.has(v) && !fieldWrites.unsanitized.has(v)) sanitizedVars.add(v);
+          }
         }
+        for (const v of fieldWrites.sanitized) sanitizedVars.add(v);
         for (const v of credit.guardedVarsAt(sink.type, sink.line)) sanitizedVars.add(v);
         for (const v of credit.safeBuilders(sanitizedVars, sink.line)) sanitizedVars.add(v);
         const received = credit.sinkText(sink.line);
@@ -43190,6 +43535,15 @@ function isReactHtmlComponent(m, f, lines) {
   const sig = lines[m.start_line - 1] ?? "";
   return /\bfunction\s+[A-Z][A-Za-z0-9]*\s*\(\s*\{/.test(sig);
 }
+function isPythonYamlLoadParamDeser(f, lines) {
+  if (f.source_type !== "interprocedural_param" || f.sink_type !== "deserialization") return false;
+  const head = f.path[0]?.variable;
+  if (!head || f.path.length < 2) return false;
+  const sinkLine = lines[f.sink_line - 1] ?? "";
+  if (!/\byaml\.load\s*\(/.test(sinkLine) || /\bLoader\s*=\s*yaml\.SafeLoader/.test(sinkLine)) return false;
+  const esc = head.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\byaml\\.load\\s*\\(\\s*${esc}\\b`).test(sinkLine);
+}
 var FIELD_CARRIED_SOURCE = /constructor-injected field|returns tainted field/;
 var EXECUTOR_CALLEES = /* @__PURE__ */ new Map([
   ["submit", 0],
@@ -43329,7 +43683,7 @@ var ParamSourceFlowGatePass = class {
       let keep = true;
       if (f.source_type === "interprocedural_param" && !realSourceLines.has(f.source_line)) {
         const m = enclosingMethod(methods, f.source_line);
-        keep = m !== void 0 && (isHandler(m) || fedByRealSource(f, m) || isReactHtmlComponent(m, f, lines));
+        keep = m !== void 0 && (isHandler(m) || fedByRealSource(f, m) || isReactHtmlComponent(m, f, lines) || ctx.language === "python" && isPythonYamlLoadParamDeser(f, lines));
       }
       if (keep) flows[w++] = f;
       else {
@@ -43954,21 +44308,56 @@ function resolveJavaDerivedAnchor(varName, derived, realSourceByVar, codeLines,
   }
   return best;
 }
-function javaReceiverChainDerivedVar(code, localVar, seedVar) {
+function javaReceiverChainDerivedVar(rhsByLocal, localVar, seedVar) {
   if (!seedVar || localVar === seedVar) return false;
+  const rhsList = rhsByLocal.get(localVar);
+  if (!rhsList) return false;
   const esc = seedVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const receiverOnRhs = new RegExp(`(?:^|[^\\w.$])${esc}\\s*\\.`, "u");
+  return rhsList.some((rhs) => receiverOnRhs.test(rhs));
+}
+function defLineForUse(graph, varName, useLine) {
+  const own = (graph.defsByLine.get(useLine) ?? []).find((d2) => d2.variable === varName);
+  if (own) return own.line;
+  const use = (graph.usesByLine.get(useLine) ?? []).find((u) => u.variable === varName && u.def_id != null);
+  const d = use ? graph.defById.get(use.def_id) : void 0;
+  return d?.line ?? useLine;
+}
+function constPropFlowLookup(language, method, varName, blockLine, constProp, preferMethodScoped = false) {
+  if (language === "go") {
+    return constPropScopedVar(method, varName, blockLine, constProp);
+  }
+  if (!method || varName.includes(":")) return varName;
+  const blockScoped = constPropScopedVar(method, varName, blockLine, constProp);
+  const hasTaintBinding = (name2) => constProp.tainted.has(name2) || constProp.sanitizedVars.has(name2);
+  if (blockScoped.includes(":b") && hasTaintBinding(blockScoped)) {
+    return blockScoped;
+  }
+  const methodScoped = `${method}:${varName}`;
+  if (hasTaintBinding(methodScoped)) {
+    return methodScoped;
+  }
+  if (preferMethodScoped && method) {
+    return methodScoped;
+  }
+  return constProp.lineBlockScopes?.has(blockLine) ? blockScoped : varName;
+}
+function indexJavaLocalAssignments(code) {
   const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const index = /* @__PURE__ */ new Map();
   for (const line of code.split("\n")) {
     const trimmed = line.trimStart();
     if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+    if (!line.includes("=") || !line.includes(";")) continue;
     const m = declRe.exec(line) ?? assignRe.exec(line);
-    if (!m || m[1] !== localVar) continue;
+    if (!m) continue;
+    const list = index.get(m[1]);
     const rhs = stripJavaTrailingComment(m[2]);
-    if (receiverOnRhs.test(rhs)) return true;
+    if (list) list.push(rhs);
+    else index.set(m[1], [rhs]);
   }
-  return false;
+  return index;
 }
 function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
   const lines = typeof code === "string" ? code.split("\n") : [];
@@ -43998,10 +44387,24 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
   };
   return (step, sourceLine, sinkLine, sinkType) => {
     const method = methodAtLine(graph, step.line);
-    const scopedVar = method ? `${method}:${step.variable}` : step.variable;
-    const r = isFalsePositive(constProp, step.line, language === "go" ? scopedVar : step.variable);
+    const blockLine = defLineForUse(graph, step.variable, step.line);
+    const fpLookup = constPropFlowLookup(
+      language,
+      method,
+      step.variable,
+      blockLine,
+      constProp
+    );
+    const r = isFalsePositive(constProp, step.line, fpLookup);
     if (!r.isFalsePositive) return false;
     if (r.reason !== "variable_not_tainted") return true;
+    if (r.reason === "variable_not_tainted" && language === "java" && method && fpLookup === step.variable && !step.variable.includes(".")) {
+      const v = step.variable;
+      if (constProp.tainted.has(`${method}:${v}`)) return false;
+      for (const t of constProp.tainted) {
+        if (t.startsWith(`${method}:b`) && t.endsWith(`:${v}`)) return false;
+      }
+    }
     if (sinkType !== void 0 && constProp.sanitizedVarUncovered) {
       const unc = constProp.sanitizedVarUncovered;
       if (step.variable.includes(":")) {
@@ -44009,7 +44412,9 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
       } else {
         const method2 = methodAtLine(graph, step.line);
         if (method2) {
-          if (unc.get(`${method2}:${step.variable}`)?.has(sinkType)) return false;
+          if (unc.get(fpLookup)?.has(sinkType)) {
+            return false;
+          }
         } else if (unc.get(step.variable)?.has(sinkType)) {
           return false;
         }
@@ -44047,7 +44452,7 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
     }
     if (!d) return true;
     if (d.line === sourceLine && sources.some((s) => s.line === sourceLine && !CONTAINER_READ_SOURCES.has(s.type))) {
-      if (step.line === sinkLine && !constProp.tainted.has(scopedVar)) {
+      if (step.line === sinkLine && !constProp.tainted.has(fpLookup)) {
         for (let ln = sourceLine; ln <= sinkLine; ln++) {
           const calleeMatch = (lines[ln - 1] ?? "").match(/:=\s*(\w+)\s*\(/);
           if (calleeMatch && constProp.constantReturningMethods?.has(calleeMatch[1])) {
@@ -44071,13 +44476,17 @@ var TaintPropagationPass = class {
     const sinkFilter = ctx.getResult("sink-filter");
     const { sources, sinks, sanitizers } = sinkFilter;
     if (ctx.language === "java" && typeof ctx.code === "string") {
+      const rhsByLocal = indexJavaLocalAssignments(ctx.code);
+      const seen = /* @__PURE__ */ new Set();
       for (const s of sources) {
-        if (!s.variable) continue;
-        for (const [v] of buildJavaTaintedVars(ctx.code, /* @__PURE__ */ new Set([s.variable]))) {
-          if (v === s.variable) continue;
-          if (javaReceiverChainDerivedVar(ctx.code, v, s.variable)) {
-            constProp.tainted.add(v);
-          }
+        if (!s.variable || seen.has(s.variable)) continue;
+        seen.add(s.variable);
+        const seedVar = s.variable;
+        const candidates = [...rhsByLocal.keys()].filter((v) => !constProp.tainted.has(v) && javaReceiverChainDerivedVar(rhsByLocal, v, seedVar));
+        if (candidates.length === 0) continue;
+        const derived = buildJavaTaintedVars(ctx.code, /* @__PURE__ */ new Set([seedVar]));
+        for (const v of candidates) {
+          if (derived.has(v)) constProp.tainted.add(v);
         }
       }
     }
@@ -44222,7 +44631,15 @@ var TaintPropagationPass = class {
     for (const f of arrayFlows) {
       pushIfNew(f);
     }
-    const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp.tainted, constProp.unreachableLines, ctx.code, types) ?? [];
+    const collectionFlows = detectCollectionFlows(
+      calls,
+      sources,
+      sinks,
+      constProp,
+      ctx.code,
+      types,
+      graph
+    ) ?? [];
     for (const f of collectionFlows) {
       if (flowKeys.has(flowKey(f))) continue;
       const flowForCheck = {
@@ -44276,6 +44693,17 @@ var TaintPropagationPass = class {
         pushIfNew(f);
       }
     }
+    if ((ctx.language === "javascript" || ctx.language === "typescript") && typeof ctx.code === "string") {
+      const jsModuleFlows = detectJsModuleScopeFlows(
+        ctx.code,
+        sources,
+        sinks,
+        constProp.unreachableLines
+      ) ?? [];
+      for (const f of jsModuleFlows) {
+        pushIfNew(f);
+      }
+    }
     const sanitizedNames = constProp.sanitizedVars;
     const sanitizedUncovered = constProp.sanitizedVarUncovered;
     let finalFlows = sanitizedNames.size === 0 ? flows : flows.filter((f) => {
@@ -44689,6 +45117,85 @@ function detectGoPackageGlobalFlows(code, _calls, sources, sinks, unreachableLin
   }
   return flows;
 }
+function detectJsModuleScopeFlows(code, sources, sinks, unreachableLines) {
+  const flows = [];
+  if (!code || sinks.length === 0) return flows;
+  const lines = code.split("\n");
+  const moduleVars = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const stripped = line.replace(/\s+$/, "");
+    if (!stripped || /^[ \t]/.test(line)) continue;
+    const m = stripped.match(/^(?:let|var|const)\s+([A-Za-z_$][\w$]*)\b/);
+    if (m) moduleVars.add(m[1]);
+  }
+  if (moduleVars.size === 0) return flows;
+  const sourceVarNames = /* @__PURE__ */ new Set();
+  for (const s of sources) {
+    if (typeof s.variable === "string" && s.variable.length > 0) {
+      sourceVarNames.add(s.variable);
+    }
+  }
+  const JS_HTTP_SOURCE_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies|get)\b|\breq\.(?:param|query|body)\(/;
+  const writes = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (unreachableLines.has(i2 + 1)) continue;
+    for (const lhs of moduleVars) {
+      const declRe = new RegExp(`\\b(?:let|const|var)\\s+${lhs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+      if (declRe.test(line)) continue;
+      const m = line.match(
+        new RegExp(`\\b${lhs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=\\s*([^;]+)`)
+      );
+      if (!m) continue;
+      const rhs = m[1];
+      let taintedBy = null;
+      const onLine = sources.filter((s) => s.line === i2 + 1);
+      if (onLine.length > 0) {
+        taintedBy = { line: onLine[0].line, type: onLine[0].type };
+      } else if (JS_HTTP_SOURCE_RE.test(rhs)) {
+        taintedBy = { line: i2 + 1, type: "http_body" };
+      } else {
+        for (const v of sourceVarNames) {
+          const re = new RegExp(`(?<![A-Za-z0-9_$])${v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_$])`);
+          if (re.test(rhs)) {
+            const src = sources.find((s) => s.variable === v);
+            if (src) {
+              taintedBy = { line: src.line, type: src.type };
+              break;
+            }
+          }
+        }
+      }
+      if (!taintedBy) continue;
+      writes.push({ varName: lhs, line: i2 + 1, sourceLine: taintedBy.line, sourceType: taintedBy.type });
+    }
+  }
+  if (writes.length === 0) return flows;
+  for (const sink of sinks) {
+    if (unreachableLines.has(sink.line)) continue;
+    const sinkLineText = lines[sink.line - 1] ?? "";
+    if (!sinkLineText) continue;
+    for (const w of writes) {
+      if (w.line >= sink.line) continue;
+      const re = new RegExp(`(?<![A-Za-z0-9_$])${w.varName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_$])`);
+      if (!re.test(sinkLineText)) continue;
+      flows.push({
+        source_line: w.sourceLine,
+        sink_line: sink.line,
+        source_type: w.sourceType,
+        sink_type: sink.type,
+        path: [
+          { variable: w.varName, line: w.sourceLine, type: "source" },
+          { variable: w.varName, line: w.line, type: "assignment" },
+          { variable: w.varName, line: sink.line, type: "sink" }
+        ],
+        confidence: 0.9,
+        sanitized: false
+      });
+    }
+  }
+  return flows;
+}
 function methodHasLocalDecl(code, methodName, varName, atLine) {
   if (!code || !methodName) return false;
   const esc = methodName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -44756,7 +45263,9 @@ function isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isField
   }
   return true;
 }
-function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLines, code, types) {
+function detectCollectionFlows(calls, sources, sinks, constProp, code, types, graph) {
+  const taintedVars = constProp.tainted;
+  const unreachableLines = constProp.unreachableLines;
   const flows = [];
   const fieldNames = /* @__PURE__ */ new Set();
   for (const t of types ?? []) for (const f of t.fields ?? []) fieldNames.add(f.name);
@@ -44776,7 +45285,18 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
         }
         if (arg.variable) {
           const varName = arg.variable;
-          const scopedName = call.in_method ? `${call.in_method}:${varName}` : varName;
+          let scopedName = varName;
+          if (call.in_method) {
+            const blockLine = graph ? defLineForUse(graph, varName, call.location.line) : call.location.line;
+            scopedName = constPropFlowLookup(
+              "java",
+              call.in_method,
+              varName,
+              blockLine,
+              constProp,
+              true
+            );
+          }
           const expr = arg.expression ?? "";
           const explicitField = isFieldUseExpression(
             expr,