circle-ir 4.16.1 → 4.17.0

package/dist/browser/circle-ir.js

@@ -4663,14 +4663,43 @@ function extractJavaTypes(tree, cache, options) {
     );
     const path = node ? enclosingTypePath(node) : [];
     if (path.length > 0) t.enclosing_type = path.join(".");
-    const params = node?.childForFieldName("type_parameters");
-    if (params) {
-      const names = params.namedChildren.filter((c) => c?.type === "type_parameter").map((c) => c.namedChildren.find((x) => x?.type === "type_identifier" || x?.type === "identifier")).map((x) => x ? getNodeText(x) : "").filter(Boolean);
-      if (names.length > 0) t.type_parameters = names;
+    const tp = typeParameters(node);
+    if (tp.names.length > 0) t.type_parameters = tp.names;
+    if (Object.keys(tp.bounds).length > 0) t.type_parameter_bounds = tp.bounds;
+  }
+  const allMethods = /* @__PURE__ */ new Map();
+  for (const t of types) {
+    for (const m of t.methods) allMethods.set(`${m.start_line}:${m.name}`, m);
+  }
+  for (const kind of ["method_declaration", "constructor_declaration"]) {
+    for (const node of getNodesFromCache(tree.rootNode, kind, cache)) {
+      const name2 = getIdentifier(node, "name");
+      const info2 = name2 ? allMethods.get(`${node.startPosition.row + 1}:${name2}`) : void 0;
+      if (!info2) continue;
+      const tp = typeParameters(node);
+      if (tp.names.length > 0) info2.type_parameters = tp.names;
+      if (Object.keys(tp.bounds).length > 0) info2.type_parameter_bounds = tp.bounds;
     }
   }
   return types;
 }
+function typeParameters(node) {
+  const names = [];
+  const bounds = {};
+  const list = node ? node.childForFieldName("type_parameters") ?? node.namedChildren.find((c) => c?.type === "type_parameters") ?? null : null;
+  if (!list) return { names, bounds };
+  for (const c of list.namedChildren) {
+    if (c?.type !== "type_parameter") continue;
+    const id = c.namedChildren.find((x) => x?.type === "type_identifier" || x?.type === "identifier");
+    const name2 = id ? getNodeText(id) : "";
+    if (!name2) continue;
+    names.push(name2);
+    const bound = c.namedChildren.find((x) => x?.type === "type_bound");
+    const first = bound?.namedChildren.find((x) => x !== null && x.type !== "annotation" && x.type !== "marker_annotation");
+    if (first) bounds[name2] = getNodeText(first);
+  }
+  return { names, bounds };
+}
 function recordComponents(node) {
   const out2 = [];
   const params = node.childForFieldName("parameters");
@@ -16735,6 +16764,85 @@ function passesMutParam(line, n) {
   if (!new RegExp(String.raw`(?<![\w.])(?:[A-Za-z_]\w*(?:\s*::\s*[A-Za-z_]\w*)*)\s*\((?:[^)]*,\s*)?${n}\b`).test(line)) return false;
   return !new RegExp(String.raw`\b${n}\s*\.\s*\w+\s*\(`).test(line) || new RegExp(String.raw`(?<![\w.])\w+\s*\(\s*${n}\b`).test(line);
 }
+function findRustAllowlistTernarySanitizers(code) {
+  const masked = maskRust(code);
+  const origLines = code.split("\n");
+  const maskedLines = masked.split("\n");
+  const out2 = [];
+  const allowlistVar = (cond) => {
+    const c = cond.trim();
+    let m = new RegExp(String.raw`^!?(\w+)\s*\.\s*contains\s*\(\s*&\s*(\w+)(?:\s*\.\s*as_str\s*\(\s*\))?\s*\)$`).exec(c);
+    if (m) return m[2];
+    if (m = new RegExp(String.raw`^!\s*\[\s*${STR}(?:\s*,\s*${STR})*\s*,?\s*\]\s*\.\s*contains\s*\(\s*&\s*${VAR}\s*\)$`).exec(c)) {
+      return m[1];
+    }
+    return guardedVariable(c);
+  };
+  const LITERAL_CHAIN = /* @__PURE__ */ new Set(["to_string", "into", "to_owned", "clone"]);
+  const literalOnly = (block) => {
+    const maskedB = maskRust(block.trim());
+    if (!maskedB.trim()) return false;
+    const re = /[A-Za-z_]\w*/g;
+    let m;
+    while ((m = re.exec(maskedB)) !== null) {
+      const id = m[0];
+      if (KEYWORDS.has(id) || /[A-Z]/.test(id[0]) || LITERAL_CHAIN.has(id)) continue;
+      return false;
+    }
+    return true;
+  };
+  const usesOnlyVar = (block, name2) => {
+    const b = block.trim();
+    if (!b) return false;
+    const maskedB = maskRust(b);
+    const re = new RegExp(String.raw`(?<![\w.])${name2}\b`);
+    if (!re.test(maskedB)) return false;
+    return !readsOtherValue(b, maskedB, name2);
+  };
+  for (const m of masked.matchAll(/\blet\s+(\w+)\s*=\s*if\b/g)) {
+    const bound = m[1];
+    const at = m.index + m[0].length - 2;
+    let depth = 0;
+    let open = -1;
+    for (let i2 = at + 2; i2 < masked.length; i2++) {
+      const ch = masked[i2];
+      if (ch === "(" || ch === "[") depth++;
+      else if (ch === ")" || ch === "]") depth--;
+      else if (ch === "{" && depth === 0) {
+        open = i2;
+        break;
+      } else if (ch === ";" || ch === "}") break;
+    }
+    if (open < 0) continue;
+    const cond = code.slice(at + 2, open).trim();
+    const guarded = allowlistVar(cond);
+    if (!guarded) continue;
+    const thenClose = matchBrace(masked, open);
+    if (thenClose < 0) continue;
+    const thenBody = code.slice(open + 1, thenClose);
+    if (!/^\s*else\b/.test(masked.slice(thenClose + 1, thenClose + 10))) continue;
+    const elseOpen = masked.indexOf("{", thenClose + 1);
+    if (elseOpen < 0) continue;
+    const elseClose = matchBrace(masked, elseOpen);
+    if (elseClose < 0) continue;
+    const elseBody = code.slice(elseOpen + 1, elseClose);
+    const inverted = /^\s*!/.test(cond);
+    const ok = inverted ? literalOnly(thenBody) && usesOnlyVar(elseBody, guarded) : usesOnlyVar(thenBody, guarded) && literalOnly(elseBody);
+    if (!ok) continue;
+    const assignLine = masked.slice(0, at).split("\n").length;
+    const mention = new RegExp(String.raw`(?<![\w.])${bound}\b`);
+    for (let l = assignLine; l < origLines.length; l++) {
+      if (!mention.test(maskedLines[l])) continue;
+      out2.push({
+        type: "rust_allowlist_ternary",
+        method: "guard",
+        line: l + 1,
+        sanitizes: CREDITED_TYPES
+      });
+    }
+  }
+  return out2;
+}
 function findRustLiteralEqualityGuardSanitizers(code) {
   const masked = maskRust(code);
   const origLines = code.split("\n");
@@ -16855,7 +16963,7 @@ function findRustLiteralEqualityGuardSanitizers(code) {
       });
     }
   }
-  return out2;
+  return [...out2, ...findRustAllowlistTernarySanitizers(code)];
 }
 function statementSpan(code, masked, lineStart, endIdx) {
   let start2 = lineStart;
@@ -18233,6 +18341,7 @@ function findCSharpRequestSources(sourceCode, language) {
   const assignRe = /^\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
   const arrayElementAssignRe = /^\s*([A-Za-z_]\w*)\s*\[[^\]]+\]\s*=\s*(.+?);?\s*$/;
   const memberFieldAssignRe = /^\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+  const collectionAddRe = /^\s*([A-Za-z_]\w*)\s*\.\s*Add\s*\(\s*(.+?)\s*\)\s*;?\s*$/;
   const consoleReadRe = /\bConsole\s*\.\s*ReadLine\s*\(/;
   const envReadRe = /\bEnvironment\s*\.\s*GetEnvironmentVariables?\s*(?:\(|\[)/;
   const formFileParams = /* @__PURE__ */ new Set();
@@ -18326,6 +18435,25 @@ function findCSharpRequestSources(sourceCode, language) {
           continue;
         }
       }
+      const addEl = collectionAddRe.exec(stmt);
+      if (addEl) {
+        const [, baseName, rhs2] = addEl;
+        const type2 = classify(rhs2);
+        if (type2 && baseName) {
+          const lineNumber2 = i2 + 1;
+          if (!sources.some((s) => s.line === lineNumber2 && s.variable === baseName)) {
+            sources.push({
+              type: type2,
+              location: `${baseName}.Add(${rhs2.trim().substring(0, 50)}${rhs2.length > 50 ? "..." : ""})`,
+              severity: type2 === "db_input" ? "medium" : "high",
+              line: lineNumber2,
+              confidence: 1,
+              variable: baseName
+            });
+          }
+          continue;
+        }
+      }
       const m = assignRe.exec(stmt);
       const rhsCrossesBlock = m !== null && m[2].includes("{");
       if (!m || rhsCrossesBlock) {
@@ -26404,6 +26532,9 @@ function isInterproceduralTaintableType(typeName, language) {
       "IEnumerable",
       "ICollection",
       "IList",
+      "List",
+      "Hashtable",
+      "ArrayList",
       "Dictionary",
       "IDictionary",
       "IReadOnlyList",
@@ -32027,6 +32158,11 @@ var ConstantPropagator = class _ConstantPropagator {
   taintedArrayElements = /* @__PURE__ */ new Map();
   // Track current method name for scoping local variables
   currentMethod = null;
+  /** Start lines of nested `{ ... }` blocks — disambiguate same-named locals (#476 Collections10). */
+  blockScopeStack = [];
+  lineBlockScopes = /* @__PURE__ */ new Map();
+  /** Skip block-scope push on the method/constructor body `{ ... }` (#476). */
+  skipMethodBodyBlockScope = false;
   // Track conditional taints: which variables were tainted under which conditions
   // Maps condition expression string → set of variables tainted under that condition
   conditionalTaints = /* @__PURE__ */ new Map();
@@ -32040,6 +32176,8 @@ var ConstantPropagator = class _ConstantPropagator {
   inSynchronizedBlock = false;
   // Track iterator sources: iterator variable name → collection name it was created from
   iteratorSources = /* @__PURE__ */ new Map();
+  /** Vars assigned from `iter.next()` — do not retro-clear on later iterator rebind (#476). */
+  taintedFromIteratorNext = /* @__PURE__ */ new Set();
   // Track class field names (declared at class level, not local variables)
   classFields = /* @__PURE__ */ new Set();
   // Track tainted method parameters for inter-procedural analysis
@@ -32097,12 +32235,16 @@ var ConstantPropagator = class _ConstantPropagator {
     this.sanitizedVars.clear();
     this.sanitizedVarUncovered.clear();
     this.currentMethod = null;
+    this.blockScopeStack = [];
+    this.lineBlockScopes.clear();
+    this.skipMethodBodyBlockScope = false;
     this.conditionalTaints.clear();
     this.conditionStack = [];
     this.lineConditions.clear();
     this.synchronizedLines.clear();
     this.inSynchronizedBlock = false;
     this.iteratorSources.clear();
+    this.taintedFromIteratorNext.clear();
     this.classFields.clear();
     this.instanceFieldTaint.clear();
     this.currentClassName = null;
@@ -32127,6 +32269,9 @@ var ConstantPropagator = class _ConstantPropagator {
     const resultSymbols = new Map(this.symbols);
     for (const name2 of this.tainted) {
       if (name2.includes(":")) {
+        if (/^[^:]+:b\d+:/.test(name2)) {
+          continue;
+        }
         const unscoped = name2.substring(name2.indexOf(":") + 1);
         resultTainted.add(unscoped);
       }
@@ -32141,6 +32286,9 @@ var ConstantPropagator = class _ConstantPropagator {
     for (const [name2, value] of this.symbols) {
       if (this.goScopedNames.has(name2)) continue;
       if (name2.includes(":")) {
+        if (/^[^:]+:b\d+:/.test(name2)) {
+          continue;
+        }
         const unscoped = name2.substring(name2.indexOf(":") + 1);
         if (!resultSymbols.has(unscoped)) {
           resultSymbols.set(unscoped, value);
@@ -32150,6 +32298,7 @@ var ConstantPropagator = class _ConstantPropagator {
     return {
       symbols: resultSymbols,
       tainted: resultTainted,
+      lineBlockScopes: new Map(this.lineBlockScopes),
       unreachableLines: new Set(this.unreachableLines),
       taintedCollections: new Map(this.taintedCollections),
       taintedArrayElements: new Map(this.taintedArrayElements),
@@ -32693,6 +32842,18 @@ var ConstantPropagator = class _ConstantPropagator {
   // ===========================================================================
   // Taint Refinement
   // ===========================================================================
+  /** True when `node` is `iter.next()` (possibly under a cast). */
+  isIteratorNextExpression(node) {
+    const text = getNodeText2(node, this.source);
+    if (/\.\s*next\s*\(/.test(text)) return true;
+    let current = node;
+    if (current.type === "cast_expression" || current.type === "parenthesized_expression") {
+      current = current.childForFieldName("operand") ?? current.childForFieldName("expression");
+    }
+    if (!current || current.type !== "method_invocation") return false;
+    const nameNode = current.childForFieldName("name");
+    return nameNode ? getNodeText2(nameNode, this.source) === "next" : false;
+  }
   refineTaintFromConstants() {
     let changed = true;
     let iterations = 0;
@@ -32702,6 +32863,9 @@ var ConstantPropagator = class _ConstantPropagator {
       iterations++;
       const toRemove = [];
       for (const varName of this.tainted) {
+        if (this.taintedFromIteratorNext.has(varName)) {
+          continue;
+        }
         const symbol = this.symbols.get(varName);
         if (symbol && symbol.type !== "unknown") {
           toRemove.push(varName);
@@ -32750,6 +32914,9 @@ var ConstantPropagator = class _ConstantPropagator {
     if (this.unreachableLines.has(line)) {
       return true;
     }
+    if (this.blockScopeStack.length > 0) {
+      this.lineBlockScopes.set(line, this.blockScopeStack[this.blockScopeStack.length - 1]);
+    }
     if (this.conditionStack.length > 0 && !this.lineConditions.has(line)) {
       this.lineConditions.set(line, this.conditionStack[this.conditionStack.length - 1]);
     }
@@ -32781,6 +32948,15 @@ var ConstantPropagator = class _ConstantPropagator {
       case "if_statement":
         this.handleIfStatement(node);
         return true;
+      case "block": {
+        if (this.skipMethodBodyBlockScope) {
+          this.skipMethodBodyBlockScope = false;
+        }
+        for (const child of node.children) {
+          this.visit(child);
+        }
+        return true;
+      }
       case "switch_expression":
       case "switch_statement":
         this.handleSwitch(node);
@@ -32866,7 +33042,9 @@ var ConstantPropagator = class _ConstantPropagator {
     }
     const body2 = node.childForFieldName("body");
     if (body2) {
+      this.skipMethodBodyBlockScope = true;
       this.visit(body2);
+      this.skipMethodBodyBlockScope = false;
     }
     this.currentMethod = prevMethod;
     this.inConstructor = prevInConstructor;
@@ -32880,10 +33058,31 @@ var ConstantPropagator = class _ConstantPropagator {
     if (varName.includes(".") || varName.includes(":")) {
       return varName;
     }
+    const blockId = this.blockScopeStack.length > 0 ? this.blockScopeStack[this.blockScopeStack.length - 1] : void 0;
     if (this.currentMethod) {
-      return `${this.currentMethod}:${varName}`;
+      return blockId !== void 0 ? `${this.currentMethod}:b${blockId}:${varName}` : `${this.currentMethod}:${varName}`;
     }
-    return varName;
+    return blockId !== void 0 ? `b${blockId}:${varName}` : varName;
+  }
+  /** Innermost block → method → unscoped, for reads that may bind to an outer declaration. */
+  getScopedNameCandidates(varName) {
+    if (varName.includes(".") || varName.includes(":")) {
+      return [varName];
+    }
+    const out2 = [];
+    for (let i2 = this.blockScopeStack.length - 1; i2 >= 0; i2--) {
+      const blockId = this.blockScopeStack[i2];
+      if (this.currentMethod) {
+        out2.push(`${this.currentMethod}:b${blockId}:${varName}`);
+      } else {
+        out2.push(`b${blockId}:${varName}`);
+      }
+    }
+    if (this.currentMethod) {
+      out2.push(`${this.currentMethod}:${varName}`);
+    }
+    out2.push(varName);
+    return out2;
   }
   /**
    * Look up a variable value, checking both scoped and unscoped names.
@@ -32891,11 +33090,12 @@ var ConstantPropagator = class _ConstantPropagator {
    * either local (scoped) or global (unscoped, like class fields).
    */
   lookupSymbol(varName) {
-    if (this.currentMethod && !varName.includes(".") && !varName.includes(":")) {
-      const scopedName = `${this.currentMethod}:${varName}`;
-      const scopedValue = this.symbols.get(scopedName);
-      if (scopedValue) {
-        return scopedValue;
+    if (!varName.includes(".") && !varName.includes(":")) {
+      for (const scopedName of this.getScopedNameCandidates(varName)) {
+        const scopedValue = this.symbols.get(scopedName);
+        if (scopedValue) {
+          return scopedValue;
+        }
       }
     }
     return this.symbols.get(varName);
@@ -32947,8 +33147,22 @@ var ConstantPropagator = class _ConstantPropagator {
         this.trackIteratorsInNode(initNode);
       }
     }
-    for (const child of node.children) {
-      this.visit(child);
+    if (node.type === "while_statement" || node.type === "do_statement") {
+      const body2 = node.childForFieldName("body");
+      for (const child of node.children) {
+        if (child !== body2) this.visit(child);
+      }
+      if (body2?.type === "block") {
+        this.blockScopeStack.push(getNodeLine(body2));
+        this.visit(body2);
+        this.blockScopeStack.pop();
+      } else if (body2) {
+        this.visit(body2);
+      }
+    } else {
+      for (const child of node.children) {
+        this.visit(child);
+      }
     }
     for (const varName of loopVarNames) {
       this.symbols.set(varName, createUnknown(getNodeLine(node)));
@@ -33090,6 +33304,10 @@ var ConstantPropagator = class _ConstantPropagator {
               this.sanitizedVars.delete(scopedName);
               this.sanitizedVarUncovered.delete(scopedName);
               this.definitionNodes.set(scopedName, valueNode);
+              if (this.isIteratorNextExpression(valueNode)) {
+                this.taintedFromIteratorNext.add(scopedName);
+                this.taintedFromIteratorNext.add(varName);
+              }
               this.symbols.set(scopedName, createUnknown(line));
             } else {
               if (this.inConditionalBranch) {
@@ -33217,6 +33435,12 @@ var ConstantPropagator = class _ConstantPropagator {
       this.sanitizedVars.delete(scopedName);
       this.sanitizedVarUncovered.delete(scopedName);
       this.definitionNodes.set(scopedName, right);
+      if (this.isIteratorNextExpression(right)) {
+        this.taintedFromIteratorNext.add(scopedName);
+        if (!varName.includes(".")) {
+          this.taintedFromIteratorNext.add(varName);
+        }
+      }
       this.symbols.set(scopedName, createUnknown(line));
       if (this.inConstructor && varName.startsWith("this.")) {
         const fieldName = varName.substring(5);
@@ -34207,10 +34431,17 @@ var ConstantPropagator = class _ConstantPropagator {
       }
     }
     if (node.type === "identifier") {
-      const scopedName = this.currentMethod ? `${this.currentMethod}:${text}` : text;
-      const isTainted = this.tainted.has(scopedName) || this.tainted.has(text);
-      if (isTainted) {
-        if (this.isExcludedByCondition(scopedName) || this.isExcludedByCondition(text)) {
+      let isTainted = false;
+      let boundName = null;
+      for (const candidate of this.getScopedNameCandidates(text)) {
+        if (this.tainted.has(candidate)) {
+          isTainted = true;
+          boundName = candidate;
+          break;
+        }
+      }
+      if (isTainted && boundName) {
+        if (this.isExcludedByCondition(boundName) || this.isExcludedByCondition(text)) {
           return false;
         }
       }
@@ -34417,6 +34648,14 @@ function analyzeConstantPropagation(tree, sourceCode, options = {}) {
     options.taintedParameters ?? []
   );
 }
+function constPropScopedVar(method, varName, line, result) {
+  if (!method) return varName;
+  const blockId = result.lineBlockScopes?.get(line);
+  if (blockId !== void 0) {
+    return `${method}:b${blockId}:${varName}`;
+  }
+  return `${method}:${varName}`;
+}
 function isFalsePositive(result, sinkLine, taintedVar) {
   if (result.unreachableLines.has(sinkLine)) {
     return { isFalsePositive: true, reason: "sink_in_dead_code" };
@@ -43296,6 +43535,15 @@ function isReactHtmlComponent(m, f, lines) {
   const sig = lines[m.start_line - 1] ?? "";
   return /\bfunction\s+[A-Z][A-Za-z0-9]*\s*\(\s*\{/.test(sig);
 }
+function isPythonYamlLoadParamDeser(f, lines) {
+  if (f.source_type !== "interprocedural_param" || f.sink_type !== "deserialization") return false;
+  const head = f.path[0]?.variable;
+  if (!head || f.path.length < 2) return false;
+  const sinkLine = lines[f.sink_line - 1] ?? "";
+  if (!/\byaml\.load\s*\(/.test(sinkLine) || /\bLoader\s*=\s*yaml\.SafeLoader/.test(sinkLine)) return false;
+  const esc = head.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\byaml\\.load\\s*\\(\\s*${esc}\\b`).test(sinkLine);
+}
 var FIELD_CARRIED_SOURCE = /constructor-injected field|returns tainted field/;
 var EXECUTOR_CALLEES = /* @__PURE__ */ new Map([
   ["submit", 0],
@@ -43435,7 +43683,7 @@ var ParamSourceFlowGatePass = class {
       let keep = true;
       if (f.source_type === "interprocedural_param" && !realSourceLines.has(f.source_line)) {
         const m = enclosingMethod(methods, f.source_line);
-        keep = m !== void 0 && (isHandler(m) || fedByRealSource(f, m) || isReactHtmlComponent(m, f, lines));
+        keep = m !== void 0 && (isHandler(m) || fedByRealSource(f, m) || isReactHtmlComponent(m, f, lines) || ctx.language === "python" && isPythonYamlLoadParamDeser(f, lines));
       }
       if (keep) flows[w++] = f;
       else {
@@ -44068,6 +44316,32 @@ function javaReceiverChainDerivedVar(rhsByLocal, localVar, seedVar) {
   const receiverOnRhs = new RegExp(`(?:^|[^\\w.$])${esc}\\s*\\.`, "u");
   return rhsList.some((rhs) => receiverOnRhs.test(rhs));
 }
+function defLineForUse(graph, varName, useLine) {
+  const own = (graph.defsByLine.get(useLine) ?? []).find((d2) => d2.variable === varName);
+  if (own) return own.line;
+  const use = (graph.usesByLine.get(useLine) ?? []).find((u) => u.variable === varName && u.def_id != null);
+  const d = use ? graph.defById.get(use.def_id) : void 0;
+  return d?.line ?? useLine;
+}
+function constPropFlowLookup(language, method, varName, blockLine, constProp, preferMethodScoped = false) {
+  if (language === "go") {
+    return constPropScopedVar(method, varName, blockLine, constProp);
+  }
+  if (!method || varName.includes(":")) return varName;
+  const blockScoped = constPropScopedVar(method, varName, blockLine, constProp);
+  const hasTaintBinding = (name2) => constProp.tainted.has(name2) || constProp.sanitizedVars.has(name2);
+  if (blockScoped.includes(":b") && hasTaintBinding(blockScoped)) {
+    return blockScoped;
+  }
+  const methodScoped = `${method}:${varName}`;
+  if (hasTaintBinding(methodScoped)) {
+    return methodScoped;
+  }
+  if (preferMethodScoped && method) {
+    return methodScoped;
+  }
+  return constProp.lineBlockScopes?.has(blockLine) ? blockScoped : varName;
+}
 function indexJavaLocalAssignments(code) {
   const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
@@ -44113,10 +44387,24 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
   };
   return (step, sourceLine, sinkLine, sinkType) => {
     const method = methodAtLine(graph, step.line);
-    const scopedVar = method ? `${method}:${step.variable}` : step.variable;
-    const r = isFalsePositive(constProp, step.line, language === "go" ? scopedVar : step.variable);
+    const blockLine = defLineForUse(graph, step.variable, step.line);
+    const fpLookup = constPropFlowLookup(
+      language,
+      method,
+      step.variable,
+      blockLine,
+      constProp
+    );
+    const r = isFalsePositive(constProp, step.line, fpLookup);
     if (!r.isFalsePositive) return false;
     if (r.reason !== "variable_not_tainted") return true;
+    if (r.reason === "variable_not_tainted" && language === "java" && method && fpLookup === step.variable && !step.variable.includes(".")) {
+      const v = step.variable;
+      if (constProp.tainted.has(`${method}:${v}`)) return false;
+      for (const t of constProp.tainted) {
+        if (t.startsWith(`${method}:b`) && t.endsWith(`:${v}`)) return false;
+      }
+    }
     if (sinkType !== void 0 && constProp.sanitizedVarUncovered) {
       const unc = constProp.sanitizedVarUncovered;
       if (step.variable.includes(":")) {
@@ -44124,7 +44412,9 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
       } else {
         const method2 = methodAtLine(graph, step.line);
         if (method2) {
-          if (unc.get(`${method2}:${step.variable}`)?.has(sinkType)) return false;
+          if (unc.get(fpLookup)?.has(sinkType)) {
+            return false;
+          }
         } else if (unc.get(step.variable)?.has(sinkType)) {
           return false;
         }
@@ -44162,7 +44452,7 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
     }
     if (!d) return true;
     if (d.line === sourceLine && sources.some((s) => s.line === sourceLine && !CONTAINER_READ_SOURCES.has(s.type))) {
-      if (step.line === sinkLine && !constProp.tainted.has(scopedVar)) {
+      if (step.line === sinkLine && !constProp.tainted.has(fpLookup)) {
         for (let ln = sourceLine; ln <= sinkLine; ln++) {
           const calleeMatch = (lines[ln - 1] ?? "").match(/:=\s*(\w+)\s*\(/);
           if (calleeMatch && constProp.constantReturningMethods?.has(calleeMatch[1])) {
@@ -44341,7 +44631,15 @@ var TaintPropagationPass = class {
     for (const f of arrayFlows) {
       pushIfNew(f);
     }
-    const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp.tainted, constProp.unreachableLines, ctx.code, types) ?? [];
+    const collectionFlows = detectCollectionFlows(
+      calls,
+      sources,
+      sinks,
+      constProp,
+      ctx.code,
+      types,
+      graph
+    ) ?? [];
     for (const f of collectionFlows) {
       if (flowKeys.has(flowKey(f))) continue;
       const flowForCheck = {
@@ -44395,6 +44693,17 @@ var TaintPropagationPass = class {
         pushIfNew(f);
       }
     }
+    if ((ctx.language === "javascript" || ctx.language === "typescript") && typeof ctx.code === "string") {
+      const jsModuleFlows = detectJsModuleScopeFlows(
+        ctx.code,
+        sources,
+        sinks,
+        constProp.unreachableLines
+      ) ?? [];
+      for (const f of jsModuleFlows) {
+        pushIfNew(f);
+      }
+    }
     const sanitizedNames = constProp.sanitizedVars;
     const sanitizedUncovered = constProp.sanitizedVarUncovered;
     let finalFlows = sanitizedNames.size === 0 ? flows : flows.filter((f) => {
@@ -44808,6 +45117,85 @@ function detectGoPackageGlobalFlows(code, _calls, sources, sinks, unreachableLin
   }
   return flows;
 }
+function detectJsModuleScopeFlows(code, sources, sinks, unreachableLines) {
+  const flows = [];
+  if (!code || sinks.length === 0) return flows;
+  const lines = code.split("\n");
+  const moduleVars = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const stripped = line.replace(/\s+$/, "");
+    if (!stripped || /^[ \t]/.test(line)) continue;
+    const m = stripped.match(/^(?:let|var|const)\s+([A-Za-z_$][\w$]*)\b/);
+    if (m) moduleVars.add(m[1]);
+  }
+  if (moduleVars.size === 0) return flows;
+  const sourceVarNames = /* @__PURE__ */ new Set();
+  for (const s of sources) {
+    if (typeof s.variable === "string" && s.variable.length > 0) {
+      sourceVarNames.add(s.variable);
+    }
+  }
+  const JS_HTTP_SOURCE_RE = /\b(?:req|request)\.(?:body|query|params|headers|cookies|get)\b|\breq\.(?:param|query|body)\(/;
+  const writes = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (unreachableLines.has(i2 + 1)) continue;
+    for (const lhs of moduleVars) {
+      const declRe = new RegExp(`\\b(?:let|const|var)\\s+${lhs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+      if (declRe.test(line)) continue;
+      const m = line.match(
+        new RegExp(`\\b${lhs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=\\s*([^;]+)`)
+      );
+      if (!m) continue;
+      const rhs = m[1];
+      let taintedBy = null;
+      const onLine = sources.filter((s) => s.line === i2 + 1);
+      if (onLine.length > 0) {
+        taintedBy = { line: onLine[0].line, type: onLine[0].type };
+      } else if (JS_HTTP_SOURCE_RE.test(rhs)) {
+        taintedBy = { line: i2 + 1, type: "http_body" };
+      } else {
+        for (const v of sourceVarNames) {
+          const re = new RegExp(`(?<![A-Za-z0-9_$])${v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_$])`);
+          if (re.test(rhs)) {
+            const src = sources.find((s) => s.variable === v);
+            if (src) {
+              taintedBy = { line: src.line, type: src.type };
+              break;
+            }
+          }
+        }
+      }
+      if (!taintedBy) continue;
+      writes.push({ varName: lhs, line: i2 + 1, sourceLine: taintedBy.line, sourceType: taintedBy.type });
+    }
+  }
+  if (writes.length === 0) return flows;
+  for (const sink of sinks) {
+    if (unreachableLines.has(sink.line)) continue;
+    const sinkLineText = lines[sink.line - 1] ?? "";
+    if (!sinkLineText) continue;
+    for (const w of writes) {
+      if (w.line >= sink.line) continue;
+      const re = new RegExp(`(?<![A-Za-z0-9_$])${w.varName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_$])`);
+      if (!re.test(sinkLineText)) continue;
+      flows.push({
+        source_line: w.sourceLine,
+        sink_line: sink.line,
+        source_type: w.sourceType,
+        sink_type: sink.type,
+        path: [
+          { variable: w.varName, line: w.sourceLine, type: "source" },
+          { variable: w.varName, line: w.line, type: "assignment" },
+          { variable: w.varName, line: sink.line, type: "sink" }
+        ],
+        confidence: 0.9,
+        sanitized: false
+      });
+    }
+  }
+  return flows;
+}
 function methodHasLocalDecl(code, methodName, varName, atLine) {
   if (!code || !methodName) return false;
   const esc = methodName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -44875,7 +45263,9 @@ function isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isField
   }
   return true;
 }
-function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLines, code, types) {
+function detectCollectionFlows(calls, sources, sinks, constProp, code, types, graph) {
+  const taintedVars = constProp.tainted;
+  const unreachableLines = constProp.unreachableLines;
   const flows = [];
   const fieldNames = /* @__PURE__ */ new Set();
   for (const t of types ?? []) for (const f of t.fields ?? []) fieldNames.add(f.name);
@@ -44895,7 +45285,18 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
         }
         if (arg.variable) {
           const varName = arg.variable;
-          const scopedName = call.in_method ? `${call.in_method}:${varName}` : varName;
+          let scopedName = varName;
+          if (call.in_method) {
+            const blockLine = graph ? defLineForUse(graph, varName, call.location.line) : call.location.line;
+            scopedName = constPropFlowLookup(
+              "java",
+              call.in_method,
+              varName,
+              blockLine,
+              constProp,
+              true
+            );
+          }
           const expr = arg.expression ?? "";
           const explicitField = isFieldUseExpression(
             expr,