circle-ir 4.16.1 → 4.17.0

package/dist/analysis/constant-propagation/index.d.ts

@@ -30,6 +30,8 @@ export declare function analyzeConstantPropagation(tree: Tree, sourceCode: strin
  * @param taintedVar - Name of the potentially tainted variable
  * @returns Object indicating if it's a false positive and the reason
  */
+/** Const-prop variable key for a use at `line` (block-scoped locals when recorded). */
+export declare function constPropScopedVar(method: string | null | undefined, varName: string, line: number, result: ConstantPropagatorResult): string;
 export declare function isFalsePositive(result: ConstantPropagatorResult, sinkLine: number, taintedVar: string): {
     isFalsePositive: boolean;
     reason: string | null;

package/dist/analysis/constant-propagation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAIvF,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGtI,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlG,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAG3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,0BAA+B,GACvC,wBAAwB,CAS1B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB;IAAE,eAAe,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA8CrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE;IAAE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC1G,OAAO,CA2CT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAIvF,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGtI,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlG,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAG3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,0BAA+B,GACvC,wBAAwB,CAS1B;AAED;;;;;;;GAOG;AACH,uFAAuF;AACvF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,wBAAwB,GAC/B,MAAM,CAOR;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB;IAAE,eAAe,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA8CrD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE;IAAE,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAC1G,OAAO,CA2CT"}

package/dist/analysis/constant-propagation/index.js

@@ -34,6 +34,16 @@ export function analyzeConstantPropagation(tree, sourceCode, options = {}) {
  * @param taintedVar - Name of the potentially tainted variable
  * @returns Object indicating if it's a false positive and the reason
  */
+/** Const-prop variable key for a use at `line` (block-scoped locals when recorded). */
+export function constPropScopedVar(method, varName, line, result) {
+    if (!method)
+        return varName;
+    const blockId = result.lineBlockScopes?.get(line);
+    if (blockId !== undefined) {
+        return `${method}:b${blockId}:${varName}`;
+    }
+    return `${method}:${varName}`;
+}
 export function isFalsePositive(result, sinkLine, taintedVar) {
     // Reason 1: Sink is in dead code
     if (result.unreachableLines.has(sinkLine)) {

package/dist/analysis/constant-propagation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAKrD,sBAAsB;AACtB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElG,qBAAqB;AACrB,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAE3G,oBAAoB;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAAU,EACV,UAAkB,EAClB,OAAO,GAA+B,EAAE;IAExC,MAAM,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC5C,OAAO,UAAU,CAAC,OAAO,CACvB,IAAI,EACJ,UAAU,EACV,OAAO,CAAC,uBAAuB,IAAI,EAAE,EACrC,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAC9B,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAgC,EAChC,QAAgB,EAChB,UAAkB;IAElB,iCAAiC;IACjC,IAAI,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChE,CAAC;IAED,sDAAsD;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,kCAAkC;IAClC,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,oBAAoB;IACpB,EAAE;IACF,sEAAsE;IACtE,sEAAsE;IACtE,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,gEAAgE;IAChE,uEAAuE;IACvE,wEAAwE;IACxE,sDAAsD;IACtD,wEAAwE;IACxE,yEAAyE;IACzE,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,IAA2G;IAE3G,8CAA8C;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,CAAC,sCAAsC;IACtD,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,gDAAgD;QAChD,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,CAAC;QAElE,uDAAuD;QACvD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACjF,8EAA8E;YAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC/B,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;gBACD,oEAAoE;gBACpE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;oBACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC;wBACzC,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO;oBAAE,MAAM;YACrB,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,yEAAyE;gBACzE,IAAI,oBAAoB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC,CAAC,0BAA0B;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAExC,4CAA4C;IAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAC9B,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAKrD,sBAAsB;AACtB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElG,qBAAqB;AACrB,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAE3G,oBAAoB;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,IAAU,EACV,UAAkB,EAClB,OAAO,GAA+B,EAAE;IAExC,MAAM,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC5C,OAAO,UAAU,CAAC,OAAO,CACvB,IAAI,EACJ,UAAU,EACV,OAAO,CAAC,uBAAuB,IAAI,EAAE,EACrC,OAAO,CAAC,gBAAgB,IAAI,EAAE,EAC9B,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAChC,MAAiC,EACjC,OAAe,EACf,IAAY,EACZ,MAAgC;IAEhC,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,KAAK,OAAO,IAAI,OAAO,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAAgC,EAChC,QAAgB,EAChB,UAAkB;IAElB,iCAAiC;IACjC,IAAI,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChE,CAAC;IAED,sDAAsD;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,kCAAkC;IAClC,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,oBAAoB;IACpB,EAAE;IACF,sEAAsE;IACtE,sEAAsE;IACtE,EAAE;IACF,oEAAoE;IACpE,0EAA0E;IAC1E,gEAAgE;IAChE,uEAAuE;IACvE,wEAAwE;IACxE,sDAAsD;IACtD,wEAAwE;IACxE,yEAAyE;IACzE,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,IAA2G;IAE3G,8CAA8C;IAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,CAAC,sCAAsC;IACtD,CAAC;IAED,wCAAwC;IACxC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,gDAAgD;QAChD,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,CAAC;QAElE,uDAAuD;QACvD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;YACjF,8EAA8E;YAC9E,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC/B,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;gBACD,oEAAoE;gBACpE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;oBACrC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC;wBACzC,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO;oBAAE,MAAM;YACrB,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,yEAAyE;gBACzE,IAAI,oBAAoB,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC,CAAC,0BAA0B;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa;IACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAExC,4CAA4C;IAC5C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAC9B,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,QAAQ,GAAG,KAAK,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/analysis/constant-propagation/propagator.d.ts

@@ -49,12 +49,19 @@ export declare class ConstantPropagator {
     private loopVariables;
     private taintedArrayElements;
     private currentMethod;
+    /** Start lines of nested `{ ... }` blocks — disambiguate same-named locals (#476 Collections10). */
+    private blockScopeStack;
+    private lineBlockScopes;
+    /** Skip block-scope push on the method/constructor body `{ ... }` (#476). */
+    private skipMethodBodyBlockScope;
     private conditionalTaints;
     private conditionStack;
     private lineConditions;
     private synchronizedLines;
     private inSynchronizedBlock;
     private iteratorSources;
+    /** Vars assigned from `iter.next()` — do not retro-clear on later iterator rebind (#476). */
+    private taintedFromIteratorNext;
     private classFields;
     private taintedParametersList;
     private instanceFieldTaint;
@@ -152,6 +159,8 @@ export declare class ConstantPropagator {
     private consequenceContainsThrow;
     private seedPythonModuleConstants;
     private getMethodName;
+    /** True when `node` is `iter.next()` (possibly under a cast). */
+    private isIteratorNextExpression;
     private refineTaintFromConstants;
     private visit;
     /**
@@ -170,6 +179,8 @@ export declare class ConstantPropagator {
      * This ensures local variables from different methods don't conflict.
      */
     private getScopedName;
+    /** Innermost block → method → unscoped, for reads that may bind to an outer declaration. */
+    private getScopedNameCandidates;
     /**
      * Look up a variable value, checking both scoped and unscoped names.
      * This handles cases where we need to find a variable that might be

package/dist/analysis/constant-propagation/propagator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"propagator.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/propagator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,wBAAwB,EAAE,gBAAgB,EAAkB,MAAM,YAAY,CAAC;AAS5G;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,OAAO,CAAyC;IACxD,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,gBAAgB,CAA0B;IAClD,OAAO,CAAC,kBAAkB,CAAuC;IAEjE,OAAO,CAAC,aAAa,CAA0B;IAC/C,gGAAgG;IAChG,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,SAAS,CAAuB;IAGxC,OAAO,CAAC,eAAe,CAAgC;IAEvD,OAAO,CAAC,mBAAmB,CAAkB;IAE7C,OAAO,CAAC,qBAAqB,CAA0B;IAEvD,OAAO,CAAC,sBAAsB,CAA0B;IACxD,6FAA6F;IAC7F,OAAO,CAAC,kBAAkB,CAA0B;IACpD;;;;OAIG;IACH,OAAO,CAAC,4BAA4B,CAA0B;IAC9D,OAAO,CAAC,wBAAwB,CAA0B;IAE1D,OAAO,CAAC,sBAAsB,CAAkC;IAEhE,OAAO,CAAC,sBAAsB,CAA0B;IACxD,sGAAsG;IACtG,OAAO,CAAC,aAAa,CAA0B;IAC/C,oGAAoG;IACpG,OAAO,CAAC,aAAa,CAA0B;IAE/C,OAAO,CAAC,uBAAuB,CAAgB;IAE/C,OAAO,CAAC,YAAY,CAA6C;IAEjE,OAAO,CAAC,aAAa,CAA0B;IAE/C,OAAO,CAAC,oBAAoB,CAAuC;IAEnE,OAAO,CAAC,aAAa,CAAuB;IAG5C,OAAO,CAAC,iBAAiB,CAAuC;IAEhE,OAAO,CAAC,cAAc,CAAgB;IAEtC,OAAO,CAAC,cAAc,CAAkC;IAExD,OAAO,CAAC,iBAAiB,CAA0B;IAEnD,OAAO,CAAC,mBAAmB,CAAkB;IAE7C,OAAO,CAAC,eAAe,CAAkC;IAEzD,OAAO,CAAC,WAAW,CAA0B;IAE7C,OAAO,CAAC,qBAAqB,CAA0B;IAEvD,OAAO,CAAC,kBAAkB,CAA0C;IAEpE,OAAO,CAAC,gBAAgB,CAAuB;IAE/C,OAAO,CAAC,aAAa,CAAkB;IAEvC,OAAO,CAAC,yBAAyB,CAAkC;IAInE,OAAO,CAAC,sBAAsB,CAA4B;IAc1D,OAAO,CAAC,wBAAwB,CAAqC;IAErE;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,GAAE,MAAM,EAAO,EAAE,gBAAgB,GAAE,MAAM,EAAO,EAAE,iBAAiB,GAAE,gBAAgB,EAAO,GAAG,wBAAwB,CAiIrL;IAED;;OAEG;IACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,aAAa,CAE5C;IAED;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAEnD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElC;IAED;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErC;IAMD;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAkJ5B,OAAO,CAAC,mBAAmB;IAsD3B,OAAO,CAAC,qBAAqB;IAuD7B,kFAAkF;IAClF,OAAO,CAAC,yBAAyB;IAejC,OAAO,CAAC,mBAAmB;IA2B3B,OAAO,CAAC,eAAe;IAqBvB,OAAO,CAAC,+BAA+B;IAuCvC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IA6CpC;;;;;;;;;OASG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iCAAiC;IAqBzC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,oBAAoB;IAgB5B,OAAO,CAAC,qBAAqB;IAa7B;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IA2BjC,OAAO,CAAC,wBAAwB;IAehC,OAAO,CAAC,yBAAyB;IAoCjC,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,wBAAwB;IAkDhC,OAAO,CAAC,KAAK;IAmBb;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IA8FhB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IA8E/B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,mBAAmB;IA6E3B,OAAO,CAAC,wBAAwB;IAwBhC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA8B1B,gFAAgF;IAChF,OAAO,CAAC,mBAAmB;IAkB3B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAanC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,yBAAyB;IAgEjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IAqE1B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,gBAAgB;IAmGxB,OAAO,CAAC,4BAA4B;IASpC,8DAA8D;IAC9D,OAAO,CAAC,qBAAqB;IA2B7B,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,oBAAoB;IAc5B,OAAO,CAAC,2BAA2B;IAkBnC,OAAO,CAAC,sBAAsB;IA8C9B,OAAO,CAAC,iBAAiB;IA6HzB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAwB1B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAkB9C;IAED,OAAO,CAAC,YAAY;IAqIpB,OAAO,CAAC,aAAa;IAwBrB,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAYzB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,yFAAyF;IACzF,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,gBAAgB;IAqBxB;;;;;OAKG;IACH;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAY5B,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAKzC;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;OAIG;IACH,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAYvC;IAED;;;OAGG;IACH,8BAA8B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA+BlD;IAED;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoB5B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAiB/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA8B3B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAe/B,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAwBvC;IAED,OAAO,CAAC,uBAAuB;IAsC/B,OAAO,CAAC,uBAAuB;IAyW/B,qFAAqF;IACrF,OAAO,CAAC,qBAAqB;IA0B7B,OAAO,CAAC,oBAAoB;CAkN7B"}
+{"version":3,"file":"propagator.d.ts","sourceRoot":"","sources":["../../../src/analysis/constant-propagation/propagator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,wBAAwB,EAAE,gBAAgB,EAAkB,MAAM,YAAY,CAAC;AAS5G;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,OAAO,CAAyC;IACxD,OAAO,CAAC,OAAO,CAA0B;IACzC,OAAO,CAAC,gBAAgB,CAA0B;IAClD,OAAO,CAAC,kBAAkB,CAAuC;IAEjE,OAAO,CAAC,aAAa,CAA0B;IAC/C,gGAAgG;IAChG,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,SAAS,CAAuB;IAGxC,OAAO,CAAC,eAAe,CAAgC;IAEvD,OAAO,CAAC,mBAAmB,CAAkB;IAE7C,OAAO,CAAC,qBAAqB,CAA0B;IAEvD,OAAO,CAAC,sBAAsB,CAA0B;IACxD,6FAA6F;IAC7F,OAAO,CAAC,kBAAkB,CAA0B;IACpD;;;;OAIG;IACH,OAAO,CAAC,4BAA4B,CAA0B;IAC9D,OAAO,CAAC,wBAAwB,CAA0B;IAE1D,OAAO,CAAC,sBAAsB,CAAkC;IAEhE,OAAO,CAAC,sBAAsB,CAA0B;IACxD,sGAAsG;IACtG,OAAO,CAAC,aAAa,CAA0B;IAC/C,oGAAoG;IACpG,OAAO,CAAC,aAAa,CAA0B;IAE/C,OAAO,CAAC,uBAAuB,CAAgB;IAE/C,OAAO,CAAC,YAAY,CAA6C;IAEjE,OAAO,CAAC,aAAa,CAA0B;IAE/C,OAAO,CAAC,oBAAoB,CAAuC;IAEnE,OAAO,CAAC,aAAa,CAAuB;IAC5C,oGAAoG;IACpG,OAAO,CAAC,eAAe,CAAgB;IACvC,OAAO,CAAC,eAAe,CAAkC;IACzD,6EAA6E;IAC7E,OAAO,CAAC,wBAAwB,CAAS;IAGzC,OAAO,CAAC,iBAAiB,CAAuC;IAEhE,OAAO,CAAC,cAAc,CAAgB;IAEtC,OAAO,CAAC,cAAc,CAAkC;IAExD,OAAO,CAAC,iBAAiB,CAA0B;IAEnD,OAAO,CAAC,mBAAmB,CAAkB;IAE7C,OAAO,CAAC,eAAe,CAAkC;IACzD,6FAA6F;IAC7F,OAAO,CAAC,uBAAuB,CAA0B;IAEzD,OAAO,CAAC,WAAW,CAA0B;IAE7C,OAAO,CAAC,qBAAqB,CAA0B;IAEvD,OAAO,CAAC,kBAAkB,CAA0C;IAEpE,OAAO,CAAC,gBAAgB,CAAuB;IAE/C,OAAO,CAAC,aAAa,CAAkB;IAEvC,OAAO,CAAC,yBAAyB,CAAkC;IAInE,OAAO,CAAC,sBAAsB,CAA4B;IAc1D,OAAO,CAAC,wBAAwB,CAAqC;IAErE;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB,GAAE,MAAM,EAAO,EAAE,gBAAgB,GAAE,MAAM,EAAO,EAAE,iBAAiB,GAAE,gBAAgB,EAAO,GAAG,wBAAwB,CA4IrL;IAED;;OAEG;IACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,aAAa,CAE5C;IAED;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAEnD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElC;IAED;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErC;IAMD;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAkJ5B,OAAO,CAAC,mBAAmB;IAsD3B,OAAO,CAAC,qBAAqB;IAuD7B,kFAAkF;IAClF,OAAO,CAAC,yBAAyB;IAejC,OAAO,CAAC,mBAAmB;IA2B3B,OAAO,CAAC,eAAe;IAqBvB,OAAO,CAAC,+BAA+B;IAuCvC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IA6CpC;;;;;;;;;OASG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iCAAiC;IAqBzC;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,oBAAoB;IAgB5B,OAAO,CAAC,qBAAqB;IAa7B;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IA2BjC,OAAO,CAAC,wBAAwB;IAehC,OAAO,CAAC,yBAAyB;IAoCjC,OAAO,CAAC,aAAa;IAYrB,iEAAiE;IACjE,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,wBAAwB;IAsDhC,OAAO,CAAC,KAAK;IAmBb;;;;OAIG;IACH,OAAO,CAAC,QAAQ;IA4GhB;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAgF/B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAiBrB,4FAA4F;IAC5F,OAAO,CAAC,uBAAuB;IAoB/B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,mBAAmB;IA2F3B,OAAO,CAAC,wBAAwB;IAwBhC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA8B1B,gFAAgF;IAChF,OAAO,CAAC,mBAAmB;IAkB3B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAanC;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,yBAAyB;IAoEjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IAqE1B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,gBAAgB;IAyGxB,OAAO,CAAC,4BAA4B;IASpC,8DAA8D;IAC9D,OAAO,CAAC,qBAAqB;IA2B7B,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,oBAAoB;IAc5B,OAAO,CAAC,2BAA2B;IAkBnC,OAAO,CAAC,sBAAsB;IA8C9B,OAAO,CAAC,iBAAiB;IA6HzB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAwB1B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;;OAIG;IACH,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAkB9C;IAED,OAAO,CAAC,YAAY;IAqIpB,OAAO,CAAC,aAAa;IAwBrB,OAAO,CAAC,yBAAyB;IAajC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAYzB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAuBxB,yFAAyF;IACzF,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,gBAAgB;IAqBxB;;;;;OAKG;IACH;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAY5B,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAKzC;IAED;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;OAIG;IACH,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAYvC;IAED;;;OAGG;IACH,8BAA8B,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CA+BlD;IAED;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoB5B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAiB/B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA8B3B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAe/B,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAwBvC;IAED,OAAO,CAAC,uBAAuB;IAsC/B,OAAO,CAAC,uBAAuB;IA6W/B,qFAAqF;IACrF,OAAO,CAAC,qBAAqB;IA0B7B,OAAO,CAAC,oBAAoB;CAkN7B"}

package/dist/analysis/constant-propagation/propagator.js

@@ -63,6 +63,11 @@ export class ConstantPropagator {
     taintedArrayElements = new Map();
     // Track current method name for scoping local variables
     currentMethod = null;
+    /** Start lines of nested `{ ... }` blocks — disambiguate same-named locals (#476 Collections10). */
+    blockScopeStack = [];
+    lineBlockScopes = new Map();
+    /** Skip block-scope push on the method/constructor body `{ ... }` (#476). */
+    skipMethodBodyBlockScope = false;
     // Track conditional taints: which variables were tainted under which conditions
     // Maps condition expression string → set of variables tainted under that condition
     conditionalTaints = new Map();
@@ -76,6 +81,8 @@ export class ConstantPropagator {
     inSynchronizedBlock = false;
     // Track iterator sources: iterator variable name → collection name it was created from
     iteratorSources = new Map();
+    /** Vars assigned from `iter.next()` — do not retro-clear on later iterator rebind (#476). */
+    taintedFromIteratorNext = new Set();
     // Track class field names (declared at class level, not local variables)
     classFields = new Set();
     // Track tainted method parameters for inter-procedural analysis
@@ -133,12 +140,16 @@ export class ConstantPropagator {
         this.sanitizedVars.clear();
         this.sanitizedVarUncovered.clear();
         this.currentMethod = null;
+        this.blockScopeStack = [];
+        this.lineBlockScopes.clear();
+        this.skipMethodBodyBlockScope = false;
         this.conditionalTaints.clear();
         this.conditionStack = [];
         this.lineConditions.clear();
         this.synchronizedLines.clear();
         this.inSynchronizedBlock = false;
         this.iteratorSources.clear();
+        this.taintedFromIteratorNext.clear();
         this.classFields.clear();
         this.instanceFieldTaint.clear();
         this.currentClassName = null;
@@ -180,6 +191,9 @@ export class ConstantPropagator {
         // Add unscoped versions of scoped names for backward compatibility
         for (const name of this.tainted) {
             if (name.includes(':')) {
+                if (/^[^:]+:b\d+:/.test(name)) {
+                    continue;
+                }
                 const unscoped = name.substring(name.indexOf(':') + 1);
                 resultTainted.add(unscoped);
             }
@@ -204,6 +218,9 @@ export class ConstantPropagator {
             if (this.goScopedNames.has(name))
                 continue;
             if (name.includes(':')) {
+                if (/^[^:]+:b\d+:/.test(name)) {
+                    continue;
+                }
                 const unscoped = name.substring(name.indexOf(':') + 1);
                 // Only add if not already present (scoped version wins on conflict)
                 if (!resultSymbols.has(unscoped)) {
@@ -214,6 +231,7 @@ export class ConstantPropagator {
         return {
             symbols: resultSymbols,
             tainted: resultTainted,
+            lineBlockScopes: new Map(this.lineBlockScopes),
             unreachableLines: new Set(this.unreachableLines),
             taintedCollections: new Map(this.taintedCollections),
             taintedArrayElements: new Map(this.taintedArrayElements),
@@ -840,6 +858,20 @@ export class ConstantPropagator {
     // ===========================================================================
     // Taint Refinement
     // ===========================================================================
+    /** True when `node` is `iter.next()` (possibly under a cast). */
+    isIteratorNextExpression(node) {
+        const text = getNodeText(node, this.source);
+        if (/\.\s*next\s*\(/.test(text))
+            return true;
+        let current = node;
+        if (current.type === 'cast_expression' || current.type === 'parenthesized_expression') {
+            current = current.childForFieldName('operand') ?? current.childForFieldName('expression');
+        }
+        if (!current || current.type !== 'method_invocation')
+            return false;
+        const nameNode = current.childForFieldName('name');
+        return nameNode ? getNodeText(nameNode, this.source) === 'next' : false;
+    }
     refineTaintFromConstants() {
         let changed = true;
         let iterations = 0;
@@ -849,6 +881,9 @@ export class ConstantPropagator {
             iterations++;
             const toRemove = [];
             for (const varName of this.tainted) {
+                if (this.taintedFromIteratorNext.has(varName)) {
+                    continue;
+                }
                 const symbol = this.symbols.get(varName);
                 if (symbol && symbol.type !== 'unknown') {
                     toRemove.push(varName);
@@ -909,6 +944,9 @@ export class ConstantPropagator {
         if (this.unreachableLines.has(line)) {
             return true; // skip subtree
         }
+        if (this.blockScopeStack.length > 0) {
+            this.lineBlockScopes.set(line, this.blockScopeStack[this.blockScopeStack.length - 1]);
+        }
         // Track which condition this line is under for correlated predicate analysis
         if (this.conditionStack.length > 0 && !this.lineConditions.has(line)) {
             // Use the innermost (most recent) condition
@@ -954,6 +992,15 @@ export class ConstantPropagator {
             case 'if_statement':
                 this.handleIfStatement(node);
                 return true;
+            case 'block': {
+                if (this.skipMethodBodyBlockScope) {
+                    this.skipMethodBodyBlockScope = false;
+                }
+                for (const child of node.children) {
+                    this.visit(child);
+                }
+                return true;
+            }
             case 'switch_expression':
             case 'switch_statement':
                 this.handleSwitch(node);
@@ -1046,10 +1093,12 @@ export class ConstantPropagator {
                 }
             }
         }
-        // Visit the method body
+        // Visit the method body (do not treat the outer `{ ... }` as a nested block scope)
         const body = node.childForFieldName('body');
         if (body) {
+            this.skipMethodBodyBlockScope = true;
             this.visit(body);
+            this.skipMethodBodyBlockScope = false;
         }
         // Restore the previous method context
         this.currentMethod = prevMethod;
@@ -1065,11 +1114,36 @@ export class ConstantPropagator {
         if (varName.includes('.') || varName.includes(':')) {
             return varName;
         }
-        // Scope local variables by method name
+        const blockId = this.blockScopeStack.length > 0
+            ? this.blockScopeStack[this.blockScopeStack.length - 1]
+            : undefined;
         if (this.currentMethod) {
-            return `${this.currentMethod}:${varName}`;
+            return blockId !== undefined
+                ? `${this.currentMethod}:b${blockId}:${varName}`
+                : `${this.currentMethod}:${varName}`;
         }
-        return varName;
+        return blockId !== undefined ? `b${blockId}:${varName}` : varName;
+    }
+    /** Innermost block → method → unscoped, for reads that may bind to an outer declaration. */
+    getScopedNameCandidates(varName) {
+        if (varName.includes('.') || varName.includes(':')) {
+            return [varName];
+        }
+        const out = [];
+        for (let i = this.blockScopeStack.length - 1; i >= 0; i--) {
+            const blockId = this.blockScopeStack[i];
+            if (this.currentMethod) {
+                out.push(`${this.currentMethod}:b${blockId}:${varName}`);
+            }
+            else {
+                out.push(`b${blockId}:${varName}`);
+            }
+        }
+        if (this.currentMethod) {
+            out.push(`${this.currentMethod}:${varName}`);
+        }
+        out.push(varName);
+        return out;
     }
     /**
      * Look up a variable value, checking both scoped and unscoped names.
@@ -1077,12 +1151,12 @@ export class ConstantPropagator {
      * either local (scoped) or global (unscoped, like class fields).
      */
     lookupSymbol(varName) {
-        // First try the scoped name (local variable in current method)
-        if (this.currentMethod && !varName.includes('.') && !varName.includes(':')) {
-            const scopedName = `${this.currentMethod}:${varName}`;
-            const scopedValue = this.symbols.get(scopedName);
-            if (scopedValue) {
-                return scopedValue;
+        if (!varName.includes('.') && !varName.includes(':')) {
+            for (const scopedName of this.getScopedNameCandidates(varName)) {
+                const scopedValue = this.symbols.get(scopedName);
+                if (scopedValue) {
+                    return scopedValue;
+                }
             }
         }
         // Fall back to unscoped name (class fields, etc.)
@@ -1152,9 +1226,26 @@ export class ConstantPropagator {
                 this.trackIteratorsInNode(initNode);
             }
         }
-        // Visit all children (condition, body, etc.)
-        for (const child of node.children) {
-            this.visit(child);
+        // #476: shadowing loop locals (`String str` per while) — scope the body block only.
+        if (node.type === 'while_statement' || node.type === 'do_statement') {
+            const body = node.childForFieldName('body');
+            for (const child of node.children) {
+                if (child !== body)
+                    this.visit(child);
+            }
+            if (body?.type === 'block') {
+                this.blockScopeStack.push(getNodeLine(body));
+                this.visit(body);
+                this.blockScopeStack.pop();
+            }
+            else if (body) {
+                this.visit(body);
+            }
+        }
+        else {
+            for (const child of node.children) {
+                this.visit(child);
+            }
         }
         // After visiting children, ensure loop variables stay unknown (they may have been overwritten)
         for (const varName of loopVarNames) {
@@ -1318,6 +1409,10 @@ export class ConstantPropagator {
                             this.sanitizedVars.delete(scopedName); // No longer sanitized if receiving tainted value
                             this.sanitizedVarUncovered.delete(scopedName);
                             this.definitionNodes.set(scopedName, valueNode);
+                            if (this.isIteratorNextExpression(valueNode)) {
+                                this.taintedFromIteratorNext.add(scopedName);
+                                this.taintedFromIteratorNext.add(varName);
+                            }
                             this.symbols.set(scopedName, createUnknown(line));
                         }
                         else {
@@ -1477,6 +1572,12 @@ export class ConstantPropagator {
             this.sanitizedVars.delete(scopedName); // No longer sanitized if receiving tainted value
             this.sanitizedVarUncovered.delete(scopedName);
             this.definitionNodes.set(scopedName, right);
+            if (this.isIteratorNextExpression(right)) {
+                this.taintedFromIteratorNext.add(scopedName);
+                if (!varName.includes('.')) {
+                    this.taintedFromIteratorNext.add(varName);
+                }
+            }
             this.symbols.set(scopedName, createUnknown(line));
             // Track constructor field assignments: this.field = taintedParam
             if (this.inConstructor && varName.startsWith('this.')) {
@@ -2620,16 +2721,20 @@ export class ConstantPropagator {
             }
         }
         if (node.type === 'identifier') {
-            // Check both scoped and unscoped taint
-            // Scoped: methodName:varName (for local variables)
-            // Unscoped: varName (for class fields or when not in a method)
-            const scopedName = this.currentMethod ? `${this.currentMethod}:${text}` : text;
-            const isTainted = this.tainted.has(scopedName) || this.tainted.has(text);
-            if (isTainted) {
+            let isTainted = false;
+            let boundName = null;
+            for (const candidate of this.getScopedNameCandidates(text)) {
+                if (this.tainted.has(candidate)) {
+                    isTainted = true;
+                    boundName = candidate;
+                    break;
+                }
+            }
+            if (isTainted && boundName) {
                 // Check if this taint is excluded by correlated predicate analysis
                 // If the variable was tainted under condition C, and we're now under !C,
                 // the taint doesn't apply in this context
-                if (this.isExcludedByCondition(scopedName) || this.isExcludedByCondition(text)) {
+                if (this.isExcludedByCondition(boundName) || this.isExcludedByCondition(text)) {
                     return false;
                 }
             }