circle-ir 4.16.0 → 4.17.0

package/dist/core/circle-ir-core.cjs

@@ -4709,14 +4709,43 @@ function extractJavaTypes(tree, cache, options) {
     );
     const path = node ? enclosingTypePath(node) : [];
     if (path.length > 0) t.enclosing_type = path.join(".");
-    const params = node?.childForFieldName("type_parameters");
-    if (params) {
-      const names = params.namedChildren.filter((c) => c?.type === "type_parameter").map((c) => c.namedChildren.find((x) => x?.type === "type_identifier" || x?.type === "identifier")).map((x) => x ? getNodeText(x) : "").filter(Boolean);
-      if (names.length > 0) t.type_parameters = names;
+    const tp = typeParameters(node);
+    if (tp.names.length > 0) t.type_parameters = tp.names;
+    if (Object.keys(tp.bounds).length > 0) t.type_parameter_bounds = tp.bounds;
+  }
+  const allMethods = /* @__PURE__ */ new Map();
+  for (const t of types) {
+    for (const m of t.methods) allMethods.set(`${m.start_line}:${m.name}`, m);
+  }
+  for (const kind of ["method_declaration", "constructor_declaration"]) {
+    for (const node of getNodesFromCache(tree.rootNode, kind, cache)) {
+      const name2 = getIdentifier(node, "name");
+      const info2 = name2 ? allMethods.get(`${node.startPosition.row + 1}:${name2}`) : void 0;
+      if (!info2) continue;
+      const tp = typeParameters(node);
+      if (tp.names.length > 0) info2.type_parameters = tp.names;
+      if (Object.keys(tp.bounds).length > 0) info2.type_parameter_bounds = tp.bounds;
     }
   }
   return types;
 }
+function typeParameters(node) {
+  const names = [];
+  const bounds = {};
+  const list = node ? node.childForFieldName("type_parameters") ?? node.namedChildren.find((c) => c?.type === "type_parameters") ?? null : null;
+  if (!list) return { names, bounds };
+  for (const c of list.namedChildren) {
+    if (c?.type !== "type_parameter") continue;
+    const id = c.namedChildren.find((x) => x?.type === "type_identifier" || x?.type === "identifier");
+    const name2 = id ? getNodeText(id) : "";
+    if (!name2) continue;
+    names.push(name2);
+    const bound = c.namedChildren.find((x) => x?.type === "type_bound");
+    const first = bound?.namedChildren.find((x) => x !== null && x.type !== "annotation" && x.type !== "marker_annotation");
+    if (first) bounds[name2] = getNodeText(first);
+  }
+  return { names, bounds };
+}
 function recordComponents(node) {
   const out2 = [];
   const params = node.childForFieldName("parameters");
@@ -16490,6 +16519,9 @@ function isInterproceduralTaintableType(typeName, language) {
       "IEnumerable",
       "ICollection",
       "IList",
+      "List",
+      "Hashtable",
+      "ArrayList",
       "Dictionary",
       "IDictionary",
       "IReadOnlyList",
@@ -19793,6 +19825,11 @@ var ConstantPropagator = class _ConstantPropagator {
   taintedArrayElements = /* @__PURE__ */ new Map();
   // Track current method name for scoping local variables
   currentMethod = null;
+  /** Start lines of nested `{ ... }` blocks — disambiguate same-named locals (#476 Collections10). */
+  blockScopeStack = [];
+  lineBlockScopes = /* @__PURE__ */ new Map();
+  /** Skip block-scope push on the method/constructor body `{ ... }` (#476). */
+  skipMethodBodyBlockScope = false;
   // Track conditional taints: which variables were tainted under which conditions
   // Maps condition expression string → set of variables tainted under that condition
   conditionalTaints = /* @__PURE__ */ new Map();
@@ -19806,6 +19843,8 @@ var ConstantPropagator = class _ConstantPropagator {
   inSynchronizedBlock = false;
   // Track iterator sources: iterator variable name → collection name it was created from
   iteratorSources = /* @__PURE__ */ new Map();
+  /** Vars assigned from `iter.next()` — do not retro-clear on later iterator rebind (#476). */
+  taintedFromIteratorNext = /* @__PURE__ */ new Set();
   // Track class field names (declared at class level, not local variables)
   classFields = /* @__PURE__ */ new Set();
   // Track tainted method parameters for inter-procedural analysis
@@ -19863,12 +19902,16 @@ var ConstantPropagator = class _ConstantPropagator {
     this.sanitizedVars.clear();
     this.sanitizedVarUncovered.clear();
     this.currentMethod = null;
+    this.blockScopeStack = [];
+    this.lineBlockScopes.clear();
+    this.skipMethodBodyBlockScope = false;
     this.conditionalTaints.clear();
     this.conditionStack = [];
     this.lineConditions.clear();
     this.synchronizedLines.clear();
     this.inSynchronizedBlock = false;
     this.iteratorSources.clear();
+    this.taintedFromIteratorNext.clear();
     this.classFields.clear();
     this.instanceFieldTaint.clear();
     this.currentClassName = null;
@@ -19893,6 +19936,9 @@ var ConstantPropagator = class _ConstantPropagator {
     const resultSymbols = new Map(this.symbols);
     for (const name2 of this.tainted) {
       if (name2.includes(":")) {
+        if (/^[^:]+:b\d+:/.test(name2)) {
+          continue;
+        }
         const unscoped = name2.substring(name2.indexOf(":") + 1);
         resultTainted.add(unscoped);
       }
@@ -19907,6 +19953,9 @@ var ConstantPropagator = class _ConstantPropagator {
     for (const [name2, value] of this.symbols) {
       if (this.goScopedNames.has(name2)) continue;
       if (name2.includes(":")) {
+        if (/^[^:]+:b\d+:/.test(name2)) {
+          continue;
+        }
         const unscoped = name2.substring(name2.indexOf(":") + 1);
         if (!resultSymbols.has(unscoped)) {
           resultSymbols.set(unscoped, value);
@@ -19916,6 +19965,7 @@ var ConstantPropagator = class _ConstantPropagator {
     return {
       symbols: resultSymbols,
       tainted: resultTainted,
+      lineBlockScopes: new Map(this.lineBlockScopes),
       unreachableLines: new Set(this.unreachableLines),
       taintedCollections: new Map(this.taintedCollections),
       taintedArrayElements: new Map(this.taintedArrayElements),
@@ -20459,6 +20509,18 @@ var ConstantPropagator = class _ConstantPropagator {
   // ===========================================================================
   // Taint Refinement
   // ===========================================================================
+  /** True when `node` is `iter.next()` (possibly under a cast). */
+  isIteratorNextExpression(node) {
+    const text = getNodeText2(node, this.source);
+    if (/\.\s*next\s*\(/.test(text)) return true;
+    let current = node;
+    if (current.type === "cast_expression" || current.type === "parenthesized_expression") {
+      current = current.childForFieldName("operand") ?? current.childForFieldName("expression");
+    }
+    if (!current || current.type !== "method_invocation") return false;
+    const nameNode = current.childForFieldName("name");
+    return nameNode ? getNodeText2(nameNode, this.source) === "next" : false;
+  }
   refineTaintFromConstants() {
     let changed = true;
     let iterations = 0;
@@ -20468,6 +20530,9 @@ var ConstantPropagator = class _ConstantPropagator {
       iterations++;
       const toRemove = [];
       for (const varName of this.tainted) {
+        if (this.taintedFromIteratorNext.has(varName)) {
+          continue;
+        }
         const symbol = this.symbols.get(varName);
         if (symbol && symbol.type !== "unknown") {
           toRemove.push(varName);
@@ -20516,6 +20581,9 @@ var ConstantPropagator = class _ConstantPropagator {
     if (this.unreachableLines.has(line)) {
       return true;
     }
+    if (this.blockScopeStack.length > 0) {
+      this.lineBlockScopes.set(line, this.blockScopeStack[this.blockScopeStack.length - 1]);
+    }
     if (this.conditionStack.length > 0 && !this.lineConditions.has(line)) {
       this.lineConditions.set(line, this.conditionStack[this.conditionStack.length - 1]);
     }
@@ -20547,6 +20615,15 @@ var ConstantPropagator = class _ConstantPropagator {
       case "if_statement":
         this.handleIfStatement(node);
         return true;
+      case "block": {
+        if (this.skipMethodBodyBlockScope) {
+          this.skipMethodBodyBlockScope = false;
+        }
+        for (const child of node.children) {
+          this.visit(child);
+        }
+        return true;
+      }
       case "switch_expression":
       case "switch_statement":
         this.handleSwitch(node);
@@ -20632,7 +20709,9 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     const body2 = node.childForFieldName("body");
     if (body2) {
+      this.skipMethodBodyBlockScope = true;
       this.visit(body2);
+      this.skipMethodBodyBlockScope = false;
     }
     this.currentMethod = prevMethod;
     this.inConstructor = prevInConstructor;
@@ -20646,10 +20725,31 @@ var ConstantPropagator = class _ConstantPropagator {
     if (varName.includes(".") || varName.includes(":")) {
       return varName;
     }
+    const blockId = this.blockScopeStack.length > 0 ? this.blockScopeStack[this.blockScopeStack.length - 1] : void 0;
     if (this.currentMethod) {
-      return `${this.currentMethod}:${varName}`;
+      return blockId !== void 0 ? `${this.currentMethod}:b${blockId}:${varName}` : `${this.currentMethod}:${varName}`;
     }
-    return varName;
+    return blockId !== void 0 ? `b${blockId}:${varName}` : varName;
+  }
+  /** Innermost block → method → unscoped, for reads that may bind to an outer declaration. */
+  getScopedNameCandidates(varName) {
+    if (varName.includes(".") || varName.includes(":")) {
+      return [varName];
+    }
+    const out2 = [];
+    for (let i2 = this.blockScopeStack.length - 1; i2 >= 0; i2--) {
+      const blockId = this.blockScopeStack[i2];
+      if (this.currentMethod) {
+        out2.push(`${this.currentMethod}:b${blockId}:${varName}`);
+      } else {
+        out2.push(`b${blockId}:${varName}`);
+      }
+    }
+    if (this.currentMethod) {
+      out2.push(`${this.currentMethod}:${varName}`);
+    }
+    out2.push(varName);
+    return out2;
   }
   /**
    * Look up a variable value, checking both scoped and unscoped names.
@@ -20657,11 +20757,12 @@ var ConstantPropagator = class _ConstantPropagator {
    * either local (scoped) or global (unscoped, like class fields).
    */
   lookupSymbol(varName) {
-    if (this.currentMethod && !varName.includes(".") && !varName.includes(":")) {
-      const scopedName = `${this.currentMethod}:${varName}`;
-      const scopedValue = this.symbols.get(scopedName);
-      if (scopedValue) {
-        return scopedValue;
+    if (!varName.includes(".") && !varName.includes(":")) {
+      for (const scopedName of this.getScopedNameCandidates(varName)) {
+        const scopedValue = this.symbols.get(scopedName);
+        if (scopedValue) {
+          return scopedValue;
+        }
       }
     }
     return this.symbols.get(varName);
@@ -20713,8 +20814,22 @@ var ConstantPropagator = class _ConstantPropagator {
         this.trackIteratorsInNode(initNode);
       }
     }
-    for (const child of node.children) {
-      this.visit(child);
+    if (node.type === "while_statement" || node.type === "do_statement") {
+      const body2 = node.childForFieldName("body");
+      for (const child of node.children) {
+        if (child !== body2) this.visit(child);
+      }
+      if (body2?.type === "block") {
+        this.blockScopeStack.push(getNodeLine(body2));
+        this.visit(body2);
+        this.blockScopeStack.pop();
+      } else if (body2) {
+        this.visit(body2);
+      }
+    } else {
+      for (const child of node.children) {
+        this.visit(child);
+      }
     }
     for (const varName of loopVarNames) {
       this.symbols.set(varName, createUnknown(getNodeLine(node)));
@@ -20856,6 +20971,10 @@ var ConstantPropagator = class _ConstantPropagator {
               this.sanitizedVars.delete(scopedName);
               this.sanitizedVarUncovered.delete(scopedName);
               this.definitionNodes.set(scopedName, valueNode);
+              if (this.isIteratorNextExpression(valueNode)) {
+                this.taintedFromIteratorNext.add(scopedName);
+                this.taintedFromIteratorNext.add(varName);
+              }
               this.symbols.set(scopedName, createUnknown(line));
             } else {
               if (this.inConditionalBranch) {
@@ -20983,6 +21102,12 @@ var ConstantPropagator = class _ConstantPropagator {
       this.sanitizedVars.delete(scopedName);
       this.sanitizedVarUncovered.delete(scopedName);
       this.definitionNodes.set(scopedName, right);
+      if (this.isIteratorNextExpression(right)) {
+        this.taintedFromIteratorNext.add(scopedName);
+        if (!varName.includes(".")) {
+          this.taintedFromIteratorNext.add(varName);
+        }
+      }
       this.symbols.set(scopedName, createUnknown(line));
       if (this.inConstructor && varName.startsWith("this.")) {
         const fieldName = varName.substring(5);
@@ -21973,10 +22098,17 @@ var ConstantPropagator = class _ConstantPropagator {
       }
     }
     if (node.type === "identifier") {
-      const scopedName = this.currentMethod ? `${this.currentMethod}:${text}` : text;
-      const isTainted = this.tainted.has(scopedName) || this.tainted.has(text);
-      if (isTainted) {
-        if (this.isExcludedByCondition(scopedName) || this.isExcludedByCondition(text)) {
+      let isTainted = false;
+      let boundName = null;
+      for (const candidate of this.getScopedNameCandidates(text)) {
+        if (this.tainted.has(candidate)) {
+          isTainted = true;
+          boundName = candidate;
+          break;
+        }
+      }
+      if (isTainted && boundName) {
+        if (this.isExcludedByCondition(boundName) || this.isExcludedByCondition(text)) {
           return false;
         }
       }

package/dist/core/circle-ir-core.js

@@ -4643,14 +4643,43 @@ function extractJavaTypes(tree, cache, options) {
     );
     const path = node ? enclosingTypePath(node) : [];
     if (path.length > 0) t.enclosing_type = path.join(".");
-    const params = node?.childForFieldName("type_parameters");
-    if (params) {
-      const names = params.namedChildren.filter((c) => c?.type === "type_parameter").map((c) => c.namedChildren.find((x) => x?.type === "type_identifier" || x?.type === "identifier")).map((x) => x ? getNodeText(x) : "").filter(Boolean);
-      if (names.length > 0) t.type_parameters = names;
+    const tp = typeParameters(node);
+    if (tp.names.length > 0) t.type_parameters = tp.names;
+    if (Object.keys(tp.bounds).length > 0) t.type_parameter_bounds = tp.bounds;
+  }
+  const allMethods = /* @__PURE__ */ new Map();
+  for (const t of types) {
+    for (const m of t.methods) allMethods.set(`${m.start_line}:${m.name}`, m);
+  }
+  for (const kind of ["method_declaration", "constructor_declaration"]) {
+    for (const node of getNodesFromCache(tree.rootNode, kind, cache)) {
+      const name2 = getIdentifier(node, "name");
+      const info2 = name2 ? allMethods.get(`${node.startPosition.row + 1}:${name2}`) : void 0;
+      if (!info2) continue;
+      const tp = typeParameters(node);
+      if (tp.names.length > 0) info2.type_parameters = tp.names;
+      if (Object.keys(tp.bounds).length > 0) info2.type_parameter_bounds = tp.bounds;
     }
   }
   return types;
 }
+function typeParameters(node) {
+  const names = [];
+  const bounds = {};
+  const list = node ? node.childForFieldName("type_parameters") ?? node.namedChildren.find((c) => c?.type === "type_parameters") ?? null : null;
+  if (!list) return { names, bounds };
+  for (const c of list.namedChildren) {
+    if (c?.type !== "type_parameter") continue;
+    const id = c.namedChildren.find((x) => x?.type === "type_identifier" || x?.type === "identifier");
+    const name2 = id ? getNodeText(id) : "";
+    if (!name2) continue;
+    names.push(name2);
+    const bound = c.namedChildren.find((x) => x?.type === "type_bound");
+    const first = bound?.namedChildren.find((x) => x !== null && x.type !== "annotation" && x.type !== "marker_annotation");
+    if (first) bounds[name2] = getNodeText(first);
+  }
+  return { names, bounds };
+}
 function recordComponents(node) {
   const out2 = [];
   const params = node.childForFieldName("parameters");
@@ -16424,6 +16453,9 @@ function isInterproceduralTaintableType(typeName, language) {
       "IEnumerable",
       "ICollection",
       "IList",
+      "List",
+      "Hashtable",
+      "ArrayList",
       "Dictionary",
       "IDictionary",
       "IReadOnlyList",
@@ -19727,6 +19759,11 @@ var ConstantPropagator = class _ConstantPropagator {
   taintedArrayElements = /* @__PURE__ */ new Map();
   // Track current method name for scoping local variables
   currentMethod = null;
+  /** Start lines of nested `{ ... }` blocks — disambiguate same-named locals (#476 Collections10). */
+  blockScopeStack = [];
+  lineBlockScopes = /* @__PURE__ */ new Map();
+  /** Skip block-scope push on the method/constructor body `{ ... }` (#476). */
+  skipMethodBodyBlockScope = false;
   // Track conditional taints: which variables were tainted under which conditions
   // Maps condition expression string → set of variables tainted under that condition
   conditionalTaints = /* @__PURE__ */ new Map();
@@ -19740,6 +19777,8 @@ var ConstantPropagator = class _ConstantPropagator {
   inSynchronizedBlock = false;
   // Track iterator sources: iterator variable name → collection name it was created from
   iteratorSources = /* @__PURE__ */ new Map();
+  /** Vars assigned from `iter.next()` — do not retro-clear on later iterator rebind (#476). */
+  taintedFromIteratorNext = /* @__PURE__ */ new Set();
   // Track class field names (declared at class level, not local variables)
   classFields = /* @__PURE__ */ new Set();
   // Track tainted method parameters for inter-procedural analysis
@@ -19797,12 +19836,16 @@ var ConstantPropagator = class _ConstantPropagator {
     this.sanitizedVars.clear();
     this.sanitizedVarUncovered.clear();
     this.currentMethod = null;
+    this.blockScopeStack = [];
+    this.lineBlockScopes.clear();
+    this.skipMethodBodyBlockScope = false;
     this.conditionalTaints.clear();
     this.conditionStack = [];
     this.lineConditions.clear();
     this.synchronizedLines.clear();
     this.inSynchronizedBlock = false;
     this.iteratorSources.clear();
+    this.taintedFromIteratorNext.clear();
     this.classFields.clear();
     this.instanceFieldTaint.clear();
     this.currentClassName = null;
@@ -19827,6 +19870,9 @@ var ConstantPropagator = class _ConstantPropagator {
     const resultSymbols = new Map(this.symbols);
     for (const name2 of this.tainted) {
       if (name2.includes(":")) {
+        if (/^[^:]+:b\d+:/.test(name2)) {
+          continue;
+        }
         const unscoped = name2.substring(name2.indexOf(":") + 1);
         resultTainted.add(unscoped);
       }
@@ -19841,6 +19887,9 @@ var ConstantPropagator = class _ConstantPropagator {
     for (const [name2, value] of this.symbols) {
       if (this.goScopedNames.has(name2)) continue;
       if (name2.includes(":")) {
+        if (/^[^:]+:b\d+:/.test(name2)) {
+          continue;
+        }
         const unscoped = name2.substring(name2.indexOf(":") + 1);
         if (!resultSymbols.has(unscoped)) {
           resultSymbols.set(unscoped, value);
@@ -19850,6 +19899,7 @@ var ConstantPropagator = class _ConstantPropagator {
     return {
       symbols: resultSymbols,
       tainted: resultTainted,
+      lineBlockScopes: new Map(this.lineBlockScopes),
       unreachableLines: new Set(this.unreachableLines),
       taintedCollections: new Map(this.taintedCollections),
       taintedArrayElements: new Map(this.taintedArrayElements),
@@ -20393,6 +20443,18 @@ var ConstantPropagator = class _ConstantPropagator {
   // ===========================================================================
   // Taint Refinement
   // ===========================================================================
+  /** True when `node` is `iter.next()` (possibly under a cast). */
+  isIteratorNextExpression(node) {
+    const text = getNodeText2(node, this.source);
+    if (/\.\s*next\s*\(/.test(text)) return true;
+    let current = node;
+    if (current.type === "cast_expression" || current.type === "parenthesized_expression") {
+      current = current.childForFieldName("operand") ?? current.childForFieldName("expression");
+    }
+    if (!current || current.type !== "method_invocation") return false;
+    const nameNode = current.childForFieldName("name");
+    return nameNode ? getNodeText2(nameNode, this.source) === "next" : false;
+  }
   refineTaintFromConstants() {
     let changed = true;
     let iterations = 0;
@@ -20402,6 +20464,9 @@ var ConstantPropagator = class _ConstantPropagator {
       iterations++;
       const toRemove = [];
       for (const varName of this.tainted) {
+        if (this.taintedFromIteratorNext.has(varName)) {
+          continue;
+        }
         const symbol = this.symbols.get(varName);
         if (symbol && symbol.type !== "unknown") {
           toRemove.push(varName);
@@ -20450,6 +20515,9 @@ var ConstantPropagator = class _ConstantPropagator {
     if (this.unreachableLines.has(line)) {
       return true;
     }
+    if (this.blockScopeStack.length > 0) {
+      this.lineBlockScopes.set(line, this.blockScopeStack[this.blockScopeStack.length - 1]);
+    }
     if (this.conditionStack.length > 0 && !this.lineConditions.has(line)) {
       this.lineConditions.set(line, this.conditionStack[this.conditionStack.length - 1]);
     }
@@ -20481,6 +20549,15 @@ var ConstantPropagator = class _ConstantPropagator {
       case "if_statement":
         this.handleIfStatement(node);
         return true;
+      case "block": {
+        if (this.skipMethodBodyBlockScope) {
+          this.skipMethodBodyBlockScope = false;
+        }
+        for (const child of node.children) {
+          this.visit(child);
+        }
+        return true;
+      }
       case "switch_expression":
       case "switch_statement":
         this.handleSwitch(node);
@@ -20566,7 +20643,9 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     const body2 = node.childForFieldName("body");
     if (body2) {
+      this.skipMethodBodyBlockScope = true;
       this.visit(body2);
+      this.skipMethodBodyBlockScope = false;
     }
     this.currentMethod = prevMethod;
     this.inConstructor = prevInConstructor;
@@ -20580,10 +20659,31 @@ var ConstantPropagator = class _ConstantPropagator {
     if (varName.includes(".") || varName.includes(":")) {
       return varName;
     }
+    const blockId = this.blockScopeStack.length > 0 ? this.blockScopeStack[this.blockScopeStack.length - 1] : void 0;
     if (this.currentMethod) {
-      return `${this.currentMethod}:${varName}`;
+      return blockId !== void 0 ? `${this.currentMethod}:b${blockId}:${varName}` : `${this.currentMethod}:${varName}`;
     }
-    return varName;
+    return blockId !== void 0 ? `b${blockId}:${varName}` : varName;
+  }
+  /** Innermost block → method → unscoped, for reads that may bind to an outer declaration. */
+  getScopedNameCandidates(varName) {
+    if (varName.includes(".") || varName.includes(":")) {
+      return [varName];
+    }
+    const out2 = [];
+    for (let i2 = this.blockScopeStack.length - 1; i2 >= 0; i2--) {
+      const blockId = this.blockScopeStack[i2];
+      if (this.currentMethod) {
+        out2.push(`${this.currentMethod}:b${blockId}:${varName}`);
+      } else {
+        out2.push(`b${blockId}:${varName}`);
+      }
+    }
+    if (this.currentMethod) {
+      out2.push(`${this.currentMethod}:${varName}`);
+    }
+    out2.push(varName);
+    return out2;
   }
   /**
    * Look up a variable value, checking both scoped and unscoped names.
@@ -20591,11 +20691,12 @@ var ConstantPropagator = class _ConstantPropagator {
    * either local (scoped) or global (unscoped, like class fields).
    */
   lookupSymbol(varName) {
-    if (this.currentMethod && !varName.includes(".") && !varName.includes(":")) {
-      const scopedName = `${this.currentMethod}:${varName}`;
-      const scopedValue = this.symbols.get(scopedName);
-      if (scopedValue) {
-        return scopedValue;
+    if (!varName.includes(".") && !varName.includes(":")) {
+      for (const scopedName of this.getScopedNameCandidates(varName)) {
+        const scopedValue = this.symbols.get(scopedName);
+        if (scopedValue) {
+          return scopedValue;
+        }
       }
     }
     return this.symbols.get(varName);
@@ -20647,8 +20748,22 @@ var ConstantPropagator = class _ConstantPropagator {
         this.trackIteratorsInNode(initNode);
       }
     }
-    for (const child of node.children) {
-      this.visit(child);
+    if (node.type === "while_statement" || node.type === "do_statement") {
+      const body2 = node.childForFieldName("body");
+      for (const child of node.children) {
+        if (child !== body2) this.visit(child);
+      }
+      if (body2?.type === "block") {
+        this.blockScopeStack.push(getNodeLine(body2));
+        this.visit(body2);
+        this.blockScopeStack.pop();
+      } else if (body2) {
+        this.visit(body2);
+      }
+    } else {
+      for (const child of node.children) {
+        this.visit(child);
+      }
     }
     for (const varName of loopVarNames) {
       this.symbols.set(varName, createUnknown(getNodeLine(node)));
@@ -20790,6 +20905,10 @@ var ConstantPropagator = class _ConstantPropagator {
               this.sanitizedVars.delete(scopedName);
               this.sanitizedVarUncovered.delete(scopedName);
               this.definitionNodes.set(scopedName, valueNode);
+              if (this.isIteratorNextExpression(valueNode)) {
+                this.taintedFromIteratorNext.add(scopedName);
+                this.taintedFromIteratorNext.add(varName);
+              }
               this.symbols.set(scopedName, createUnknown(line));
             } else {
               if (this.inConditionalBranch) {
@@ -20917,6 +21036,12 @@ var ConstantPropagator = class _ConstantPropagator {
       this.sanitizedVars.delete(scopedName);
       this.sanitizedVarUncovered.delete(scopedName);
       this.definitionNodes.set(scopedName, right);
+      if (this.isIteratorNextExpression(right)) {
+        this.taintedFromIteratorNext.add(scopedName);
+        if (!varName.includes(".")) {
+          this.taintedFromIteratorNext.add(varName);
+        }
+      }
       this.symbols.set(scopedName, createUnknown(line));
       if (this.inConstructor && varName.startsWith("this.")) {
         const fieldName = varName.substring(5);
@@ -21907,10 +22032,17 @@ var ConstantPropagator = class _ConstantPropagator {
       }
     }
     if (node.type === "identifier") {
-      const scopedName = this.currentMethod ? `${this.currentMethod}:${text}` : text;
-      const isTainted = this.tainted.has(scopedName) || this.tainted.has(text);
-      if (isTainted) {
-        if (this.isExcludedByCondition(scopedName) || this.isExcludedByCondition(text)) {
+      let isTainted = false;
+      let boundName = null;
+      for (const candidate of this.getScopedNameCandidates(text)) {
+        if (this.tainted.has(candidate)) {
+          isTainted = true;
+          boundName = candidate;
+          break;
+        }
+      }
+      if (isTainted && boundName) {
+        if (this.isExcludedByCondition(boundName) || this.isExcludedByCondition(text)) {
           return false;
         }
       }