circle-ir 4.16.1 → 4.18.1

package/dist/analysis/passes/sink-filter-pass.js

@@ -290,6 +290,106 @@ function argvFirstLiteralIsShell(lineText) {
         .toLowerCase();
     return SHELL_PROGRAMS.has(base);
 }
+/** Last RHS assigned to `varName` on a line before `beforeLine` inside the method span. */
+function javaLocalInitRhsBeforeLine(varName, beforeLine, methodStart, methodEnd, sourceLines) {
+    const declAssign = new RegExp(`^\\s*(?:final\\s+)?[\\w<>,\\s\\[\\]]+\\s+${escapeReSf(varName)}\\s*=\\s*(.+?)\\s*;\\s*(?://.*)?$`);
+    const reassign = new RegExp(`^\\s*${escapeReSf(varName)}\\s*=\\s*(.+?)\\s*;\\s*(?://.*)?$`);
+    let lastRhs;
+    for (let l = methodStart; l < beforeLine && l <= methodEnd; l++) {
+        const line = (sourceLines[l - 1] ?? '').trim();
+        const m = declAssign.exec(line) ?? reassign.exec(line);
+        if (m)
+            lastRhs = m[1].trim();
+    }
+    return lastRhs;
+}
+function callArgLooksLikeShellArgv(expr, probePrefix) {
+    return argvFirstLiteralIsShell(`${probePrefix}${expr}`);
+}
+function parseSimpleJavaCall(expr) {
+    const trimmed = expr.trim();
+    const m = /^([\w][\w.]*)\s*\(/.exec(trimmed);
+    if (!m)
+        return null;
+    const head = m[1];
+    const dot = head.lastIndexOf('.');
+    if (dot < 0)
+        return { method: head };
+    return { qualifier: head.slice(0, dot), method: head.slice(dot + 1) };
+}
+function javaMethodBodyReturnLooksLikeShellArgv(methodStart, methodEnd, sourceLines) {
+    for (let l = methodStart; l <= methodEnd; l++) {
+        const line = (sourceLines[l - 1] ?? '').trim();
+        const ret = /\breturn\s+(.+?)\s*;/.exec(line);
+        if (!ret)
+            continue;
+        if (callArgLooksLikeShellArgv(ret[1].trim(), 'new ProcessBuilder('))
+            return true;
+    }
+    return false;
+}
+function javaResolveCalleeMethodLines(methodName, qualifier, refLine, types, sourceLines, ctx) {
+    const enclosing = types.find(t => refLine >= t.start_line && refLine <= t.end_line);
+    const typeName = qualifier
+        ? (qualifier.includes('.') ? qualifier.split('.').pop() : qualifier)
+        : enclosing?.name;
+    if (!typeName)
+        return undefined;
+    const tryType = (t, lines) => {
+        const mm = t.methods.find(m => m.name === methodName);
+        if (!mm)
+            return undefined;
+        return { start: mm.start_line, end: mm.end_line, lines };
+    };
+    if (ctx?.projectGraph && ctx.sourceLinesByFile) {
+        for (const fp of ctx.projectGraph.filePaths) {
+            const ir = ctx.projectGraph.getIR(fp);
+            if (!ir)
+                continue;
+            const t = ir.types.find(tt => tt.name === typeName);
+            if (!t)
+                continue;
+            const lines = ctx.sourceLinesByFile.get(fp);
+            if (!lines)
+                continue;
+            const hit = tryType(t, lines);
+            if (hit)
+                return hit;
+        }
+    }
+    const local = types.find(t => t.name === typeName);
+    if (local)
+        return tryType(local, sourceLines);
+    return undefined;
+}
+function javaExpressionLooksLikeShellArgv(expr, refLine, types, sourceLines, ctx) {
+    if (callArgLooksLikeShellArgv(expr, 'new ProcessBuilder('))
+        return true;
+    const parsed = parseSimpleJavaCall(expr);
+    if (!parsed)
+        return false;
+    const body = javaResolveCalleeMethodLines(parsed.method, parsed.qualifier, refLine, types, sourceLines, ctx);
+    if (!body)
+        return false;
+    return javaMethodBodyReturnLooksLikeShellArgv(body.start, body.end, body.lines);
+}
+/** cognium-dev#626 — shell argv written to instance field `fieldName` before `beforeLine`. */
+function javaFieldShellArgvWrittenBeforeLine(fieldName, beforeLine, methodStart, methodEnd, sourceLines, types, ctx) {
+    const cap = fieldName.charAt(0).toUpperCase() + fieldName.slice(1);
+    const beanSetter = new RegExp(`\\bset${escapeReSf(cap)}\\s*\\((.+)\\)\\s*;?\\s*$`);
+    const fieldAssign = new RegExp(`^\\s*(?:this\\.)?${escapeReSf(fieldName)}\\s*=\\s*(.+?)\\s*;\\s*(?://.*)?$`);
+    for (let l = methodStart; l < beforeLine && l <= methodEnd; l++) {
+        const line = (sourceLines[l - 1] ?? '').trim();
+        const sm = beanSetter.exec(line);
+        if (sm && javaExpressionLooksLikeShellArgv(sm[1].trim(), l, types, sourceLines, ctx)) {
+            return true;
+        }
+        const fm = fieldAssign.exec(line);
+        if (fm && callArgLooksLikeShellArgv(fm[1].trim(), 'new ProcessBuilder('))
+            return true;
+    }
+    return false;
+}
 /**
  * cognium-dev#626 — does a same-file call of the wrapper method that contains
  * the sink pass a shell argv (`Arrays.asList("/bin/sh", "-c", ...)`,
@@ -308,7 +408,7 @@ function argvFirstLiteralIsShell(lineText) {
  * type is found by its line range). A parameter that is not found answers
  * `false` and today's suppression stands.
  */
-function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, calls) {
+function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, calls, sourceLines) {
     if (!methodName)
         return false;
     for (const t of types) {
@@ -316,8 +416,25 @@ function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, c
         if (!m)
             continue;
         const pos = m.parameters.findIndex(p => p.name === paramName);
-        if (pos < 0)
-            return false;
+        if (pos < 0) {
+            const isField = t.fields?.some(f => f.name === paramName);
+            if (!isField)
+                return false;
+            return calls.some(c => {
+                if (c.method_name !== methodName)
+                    return false;
+                if (c.receiver != null && c.receiver !== 'this')
+                    return false;
+                if (c.location.line < t.start_line || c.location.line > t.end_line)
+                    return false;
+                if (c.arguments.length !== m.parameters.length)
+                    return false;
+                const callerMethod = t.methods.find(mm => c.location.line >= mm.start_line && c.location.line <= mm.end_line);
+                if (!callerMethod)
+                    return false;
+                return javaFieldShellArgvWrittenBeforeLine(paramName, c.location.line, callerMethod.start_line, callerMethod.end_line, sourceLines, types);
+            });
+        }
         return calls.some(c => {
             if (c.method_name !== methodName)
                 return false;
@@ -338,12 +455,462 @@ function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, c
                 u.methods.some(um => um.name === methodName && um.parameters.length === c.arguments.length));
             if (shadowed)
                 return false;
-            const expr = c.arguments[pos]?.expression;
-            return typeof expr === 'string' && argvFirstLiteralIsShell(`new ProcessBuilder(${expr}`);
+            const expr = (c.arguments[pos]?.expression ?? '').trim();
+            if (!expr)
+                return false;
+            if (javaExpressionLooksLikeShellArgv(expr, c.location.line, types, sourceLines)) {
+                return true;
+            }
+            const argVar = c.arguments[pos]?.variable;
+            if (argVar && expr === argVar && !/[.(]/.test(expr)) {
+                const callerMethod = t.methods.find(mm => c.location.line >= mm.start_line && c.location.line <= mm.end_line);
+                if (callerMethod) {
+                    const rhs = javaLocalInitRhsBeforeLine(argVar, c.location.line, callerMethod.start_line, callerMethod.end_line, sourceLines);
+                    if (rhs && javaExpressionLooksLikeShellArgv(rhs, c.location.line, types, sourceLines)) {
+                        return true;
+                    }
+                }
+            }
+            return false;
         });
     }
     return false;
 }
+function callArgumentIsShellArgv(call, argPos, types, sourceLines, ctx) {
+    const expr = (call.arguments[argPos]?.expression ?? '').trim();
+    if (!expr)
+        return false;
+    if (javaExpressionLooksLikeShellArgv(expr, call.location.line, types, sourceLines, ctx)) {
+        return true;
+    }
+    const argVar = call.arguments[argPos]?.variable;
+    if (argVar && expr === argVar && !/[.(]/.test(expr)) {
+        const callerType = types.find(t => call.location.line >= t.start_line && call.location.line <= t.end_line);
+        const callerMethod = callerType?.methods.find(mm => call.location.line >= mm.start_line && call.location.line <= mm.end_line);
+        if (callerMethod) {
+            const rhs = javaLocalInitRhsBeforeLine(argVar, call.location.line, callerMethod.start_line, callerMethod.end_line, sourceLines);
+            if (rhs && javaExpressionLooksLikeShellArgv(rhs, call.location.line, types, sourceLines, ctx)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function projectCallerPassesShellArgvForWrapper(paramName, wrapperMethod, sinkLine, calleeTypes, calleeCalls, calleeLines, projectGraph, sourceLinesByFile, getCallerContext, forEachCrossFileCall) {
+    const shellArgvCtx = { projectGraph, sourceLinesByFile };
+    if (sameFileCallerPassesShellArgv(paramName, wrapperMethod, sinkLine, calleeTypes, calleeCalls, calleeLines)) {
+        return true;
+    }
+    if (!wrapperMethod)
+        return false;
+    const calleeMethod = calleeTypes
+        .flatMap(t => t.methods)
+        .find(mm => mm.name === wrapperMethod && sinkLine >= mm.start_line && sinkLine <= mm.end_line);
+    const pos = calleeMethod?.parameters.findIndex(p => p.name === paramName) ?? -1;
+    if (pos < 0) {
+        if (!calleeMethod
+            || !javaFieldArgvAtSink(projectGraph, calleeTypes, paramName, wrapperMethod, sinkLine)) {
+            return false;
+        }
+        let found = false;
+        const setterName = `set${paramName.charAt(0).toUpperCase()}${paramName.slice(1)}`;
+        forEachCrossFileCall((callerFile, call, targetMethod) => {
+            const ctx = getCallerContext(callerFile);
+            if (!ctx)
+                return;
+            const callerMethod = ctx.types
+                .flatMap(t => t.methods)
+                .find(mm => call.location.line >= mm.start_line && call.location.line <= mm.end_line);
+            if (!callerMethod)
+                return;
+            if (targetMethod.endsWith(`.${setterName}`) || targetMethod.endsWith(setterName)) {
+                if (call.arguments.length > 0
+                    && callArgumentIsShellArgv(call, 0, ctx.types, ctx.lines, shellArgvCtx)) {
+                    found = true;
+                }
+                return;
+            }
+            if (!wrapperMethodMatchesTarget(wrapperMethod, targetMethod))
+                return;
+            if (call.arguments.length !== calleeMethod.parameters.length)
+                return;
+            if (javaFieldShellArgvWrittenBeforeLine(paramName, call.location.line, callerMethod.start_line, callerMethod.end_line, ctx.lines, ctx.types, shellArgvCtx)) {
+                found = true;
+            }
+        });
+        return found;
+    }
+    let found = false;
+    forEachCrossFileCall((callerFile, call, targetMethod) => {
+        if (!targetMethod.endsWith(`.${wrapperMethod}`) && !targetMethod.endsWith(wrapperMethod))
+            return;
+        if (call.arguments.length <= pos)
+            return;
+        const ctx = getCallerContext(callerFile);
+        if (!ctx)
+            return;
+        if (callArgumentIsShellArgv(call, pos, ctx.types, ctx.lines, shellArgvCtx))
+            found = true;
+    });
+    return found;
+}
+function pickCallerTaintSource(callerIr, beforeLine) {
+    const fromFlow = (callerIr.taint.flows ?? [])
+        .filter(f => f.sink_line <= beforeLine && f.source_line <= beforeLine)
+        .sort((a, b) => b.source_line - a.source_line)[0];
+    if (fromFlow) {
+        return { line: fromFlow.source_line, type: fromFlow.source_type };
+    }
+    const fromSource = (callerIr.taint.sources ?? [])
+        .filter(s => s.line <= beforeLine)
+        .sort((a, b) => b.line - a.line)[0];
+    if (fromSource) {
+        return { line: fromSource.line, type: fromSource.type };
+    }
+    return undefined;
+}
+function wrapperMethodMatchesTarget(wrapperMethod, targetMethod) {
+    return targetMethod.endsWith(`.${wrapperMethod}`) || targetMethod.endsWith(wrapperMethod);
+}
+/** Type that owns `wrapperMethod` at `sinkLine` in `types`. */
+function javaHostTypeAtSink(types, wrapperMethod, sinkLine) {
+    for (const t of types) {
+        if (t.methods.some(mm => mm.name === wrapperMethod && sinkLine >= mm.start_line && sinkLine <= mm.end_line)) {
+            return t.name;
+        }
+    }
+    return undefined;
+}
+/** Field on `typeName` or a supertype declared anywhere in the project. */
+function javaProjectTypeDeclaresField(projectGraph, typeName, fieldName) {
+    const seen = new Set();
+    const queue = [typeName];
+    while (queue.length > 0) {
+        const tn = queue.pop();
+        if (seen.has(tn))
+            continue;
+        seen.add(tn);
+        for (const fp of projectGraph.filePaths) {
+            const ir = projectGraph.getIR(fp);
+            if (!ir)
+                continue;
+            for (const t of ir.types) {
+                if (t.name !== tn)
+                    continue;
+                if (t.fields?.some(f => f.name === fieldName))
+                    return true;
+                if (t.extends)
+                    queue.push(t.extends);
+            }
+        }
+    }
+    return false;
+}
+/** Callee files for cross-file argv recall: sink file plus supertype declaration files. */
+function javaRelatedCalleeFiles(projectGraph, primaryCalleeFile, hostTypeName) {
+    const files = new Set([primaryCalleeFile]);
+    if (!hostTypeName)
+        return [...files];
+    const seen = new Set();
+    const queue = [hostTypeName];
+    while (queue.length > 0) {
+        const tn = queue.pop();
+        if (seen.has(tn))
+            continue;
+        seen.add(tn);
+        for (const fp of projectGraph.filePaths) {
+            const ir = projectGraph.getIR(fp);
+            const t = ir?.types.find(tt => tt.name === tn);
+            if (!t)
+                continue;
+            files.add(fp);
+            if (t.extends)
+                queue.push(t.extends);
+        }
+    }
+    return [...files];
+}
+function javaFieldArgvAtSink(projectGraph, calleeTypes, paramName, wrapperMethod, sinkLine) {
+    const hostType = javaHostTypeAtSink(calleeTypes, wrapperMethod, sinkLine);
+    if (!hostType)
+        return false;
+    return javaProjectTypeDeclaresField(projectGraph, hostType, paramName);
+}
+function javaProjectFieldType(projectGraph, typeName, fieldName) {
+    const seen = new Set();
+    const queue = [typeName];
+    while (queue.length > 0) {
+        const tn = queue.pop();
+        if (seen.has(tn))
+            continue;
+        seen.add(tn);
+        for (const fp of projectGraph.filePaths) {
+            const ir = projectGraph.getIR(fp);
+            if (!ir)
+                continue;
+            for (const t of ir.types) {
+                if (t.name !== tn)
+                    continue;
+                const f = t.fields?.find(ff => ff.name === fieldName);
+                if (f?.type)
+                    return f.type;
+                if (t.extends)
+                    queue.push(t.extends);
+            }
+        }
+    }
+    return null;
+}
+function resolveJavaArgvIdentifierType(varName, wrapperMethod, sinkLine, types, projectGraph) {
+    const direct = resolveIdentifierType(varName, wrapperMethod, [...types]);
+    if (direct)
+        return direct;
+    if (!wrapperMethod)
+        return null;
+    const hostType = javaHostTypeAtSink(types, wrapperMethod, sinkLine);
+    if (!hostType)
+        return null;
+    return javaProjectFieldType(projectGraph, hostType, varName);
+}
+/**
+ * cognium-dev#626 — per-file argv suppression drops the ProcessBuilder sink on
+ * isolated `List<String>` wrappers; restore cross-file recall by synthesizing
+ * flows (and project taint paths) when a resolved caller passes shell argv.
+ */
+export function synthesizeCrossFileArgvWrapperFlows(fileAnalyses, projectGraph, sourceLinesByFile, taintPaths) {
+    const getCallerContext = (file) => {
+        const ir = projectGraph.getIR(file);
+        if (!ir)
+            return undefined;
+        return {
+            types: ir.types,
+            calls: ir.calls,
+            lines: sourceLinesByFile.get(file) ?? [],
+            ir,
+        };
+    };
+    const forEachCrossFileCall = (calleeFile, cb) => {
+        for (const fromFile of projectGraph.filePaths) {
+            if (fromFile === calleeFile)
+                continue;
+            for (const rc of projectGraph.resolver.getResolvedCallsFromFile(fromFile)) {
+                if (rc.targetFile !== calleeFile)
+                    continue;
+                cb(fromFile, rc.call, rc.targetMethod);
+            }
+        }
+    };
+    for (const fa of fileAnalyses) {
+        const ir = fa.analysis;
+        if (ir.meta.language !== 'java')
+            continue;
+        const lines = sourceLinesByFile.get(fa.file) ?? [];
+        for (const ctorCall of ir.calls) {
+            if (ctorCall.method_name !== 'ProcessBuilder')
+                continue;
+            if (ctorCall.receiver != null && ctorCall.receiver !== undefined)
+                continue;
+            const sinkLine = ctorCall.location.line;
+            const sinkLineText = lines[sinkLine - 1] ?? '';
+            if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
+                continue;
+            if (argvFirstLiteralIsShell(sinkLineText))
+                continue;
+            const arg0 = ctorCall.arguments[0];
+            if (!arg0)
+                continue;
+            const varName = arg0.variable ?? '';
+            const argExpr = (arg0.expression ?? '').trim();
+            if (!varName || argExpr !== varName || /[(.]/.test(argExpr))
+                continue;
+            const wrapperMethod = ctorCall.in_method;
+            const t = resolveJavaArgvIdentifierType(varName, wrapperMethod, sinkLine, ir.types, projectGraph);
+            if (!isArgvContainerType(t))
+                continue;
+            if (sameFileCallerPassesShellArgv(varName, wrapperMethod, sinkLine, ir.types, ir.calls, lines)) {
+                continue;
+            }
+            const calleeMethod = ir.types
+                .flatMap(ty => ty.methods)
+                .find(mm => mm.name === wrapperMethod && sinkLine >= mm.start_line && sinkLine <= mm.end_line);
+            const pos = calleeMethod?.parameters.findIndex(p => p.name === varName) ?? -1;
+            const hostType = wrapperMethod
+                ? javaHostTypeAtSink(ir.types, wrapperMethod, sinkLine)
+                : undefined;
+            const fieldArgv = pos < 0
+                && wrapperMethod
+                && javaFieldArgvAtSink(projectGraph, ir.types, varName, wrapperMethod, sinkLine);
+            if (pos < 0 && !fieldArgv)
+                continue;
+            const relatedCalleeFiles = javaRelatedCalleeFiles(projectGraph, fa.file, hostType);
+            const shellArgvCtx = { projectGraph, sourceLinesByFile };
+            for (const calleeFile of relatedCalleeFiles) {
+                forEachCrossFileCall(calleeFile, (callerFile, call, targetMethod) => {
+                    const ctx = getCallerContext(callerFile);
+                    if (!ctx)
+                        return;
+                    const setterName = `set${varName.charAt(0).toUpperCase()}${varName.slice(1)}`;
+                    let shellProof = false;
+                    if (pos >= 0) {
+                        if (!wrapperMethod || !wrapperMethodMatchesTarget(wrapperMethod, targetMethod))
+                            return;
+                        if (call.arguments.length <= pos)
+                            return;
+                        shellProof = callArgumentIsShellArgv(call, pos, ctx.types, ctx.lines, shellArgvCtx);
+                    }
+                    else {
+                        const callerMethod = ctx.types
+                            .flatMap(ty => ty.methods)
+                            .find(mm => call.location.line >= mm.start_line && call.location.line <= mm.end_line);
+                        if (!callerMethod || !calleeMethod)
+                            return;
+                        if (targetMethod.endsWith(`.${setterName}`) || targetMethod.endsWith(setterName)) {
+                            shellProof =
+                                call.arguments.length > 0
+                                    && callArgumentIsShellArgv(call, 0, ctx.types, ctx.lines, shellArgvCtx);
+                        }
+                        else if (wrapperMethod && wrapperMethodMatchesTarget(wrapperMethod, targetMethod)) {
+                            shellProof =
+                                call.arguments.length === calleeMethod.parameters.length
+                                    && javaFieldShellArgvWrittenBeforeLine(varName, call.location.line, callerMethod.start_line, callerMethod.end_line, ctx.lines, ctx.types, shellArgvCtx);
+                        }
+                    }
+                    if (!shellProof)
+                        return;
+                    const source = pickCallerTaintSource(ctx.ir, call.location.line);
+                    if (!source)
+                        return;
+                    const flows = ir.taint.flows ?? [];
+                    const flowExists = flows.some(f => f.sink_type === 'command_injection'
+                        && f.sink_line === sinkLine
+                        && f.source_line === source.line
+                        && f.source_type === source.type);
+                    if (!flowExists) {
+                        flows.push({
+                            source_line: source.line,
+                            sink_line: sinkLine,
+                            source_type: source.type,
+                            sink_type: 'command_injection',
+                            path: [
+                                { variable: '', line: source.line, type: 'source' },
+                                { variable: varName, line: sinkLine, type: 'sink' },
+                            ],
+                            confidence: 0.7,
+                            sanitized: false,
+                        });
+                        ir.taint.flows = flows;
+                    }
+                    const pathDup = taintPaths.some(tp => tp.source.file === callerFile
+                        && tp.source.line === source.line
+                        && tp.sink.file === fa.file
+                        && tp.sink.line === sinkLine
+                        && tp.sink.type === 'command_injection');
+                    if (pathDup)
+                        return;
+                    const callerLines = sourceLinesByFile.get(callerFile) ?? [];
+                    const dupId = `${callerFile}:${source.line}→${fa.file}:${sinkLine}`;
+                    taintPaths.push({
+                        id: `cf-argv-626-${dupId}`,
+                        source: {
+                            file: callerFile,
+                            line: source.line,
+                            type: source.type,
+                            code: callerLines[source.line - 1] ?? '',
+                        },
+                        sink: {
+                            file: fa.file,
+                            line: sinkLine,
+                            type: 'command_injection',
+                            cwe: 'CWE-78',
+                            code: sinkLineText,
+                        },
+                        hops: [
+                            {
+                                file: callerFile,
+                                method: call.in_method ?? '',
+                                line: call.location.line,
+                                code: callerLines[call.location.line - 1] ?? '',
+                                variable: '',
+                            },
+                            {
+                                file: fa.file,
+                                method: wrapperMethod ?? '',
+                                line: sinkLine,
+                                code: sinkLineText,
+                                variable: varName,
+                            },
+                        ],
+                        sanitizers_in_path: [],
+                        path_exists: true,
+                        confidence: 0.7,
+                    });
+                });
+            }
+        }
+    }
+}
+/** cognium-dev#626 — drop argv-wrapper flows with no shell-argv caller (incl. cross-file). */
+export function filterJavaArgvWrapperFlowsWithoutShellCaller(fileAnalyses, projectGraph, sourceLinesByFile) {
+    const getCallerContext = (file) => {
+        const ir = projectGraph.getIR(file);
+        if (!ir)
+            return undefined;
+        return {
+            types: ir.types,
+            calls: ir.calls,
+            lines: sourceLinesByFile.get(file) ?? [],
+        };
+    };
+    const forEachCrossFileCall = (calleeFile, cb) => {
+        for (const fromFile of projectGraph.filePaths) {
+            if (fromFile === calleeFile)
+                continue;
+            for (const rc of projectGraph.resolver.getResolvedCallsFromFile(fromFile)) {
+                if (rc.targetFile !== calleeFile)
+                    continue;
+                cb(fromFile, rc.call, rc.targetMethod);
+            }
+        }
+    };
+    for (const fa of fileAnalyses) {
+        const ir = fa.analysis;
+        if (ir.meta.language !== 'java')
+            continue;
+        const lines = sourceLinesByFile.get(fa.file) ?? [];
+        const flows = ir.taint.flows ?? [];
+        ir.taint.flows = flows.filter(flow => {
+            if (flow.sink_type !== 'command_injection')
+                return true;
+            const sinkLineText = lines[flow.sink_line - 1] ?? '';
+            if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
+                return true;
+            const ctorCall = ir.calls.find(c => c.method_name === 'ProcessBuilder' &&
+                c.location.line === flow.sink_line &&
+                (c.receiver === null || c.receiver === undefined));
+            if (!ctorCall)
+                return true;
+            const arg0 = ctorCall.arguments[0];
+            if (!arg0)
+                return true;
+            const varName = arg0.variable ?? '';
+            const argExpr = (arg0.expression ?? '').trim();
+            if (!varName || argExpr !== varName || /[(.]/.test(argExpr))
+                return true;
+            const t = resolveJavaArgvIdentifierType(varName, ctorCall.in_method, flow.sink_line, ir.types, projectGraph);
+            if (!isArgvContainerType(t))
+                return true;
+            const hostType = ctorCall.in_method
+                ? javaHostTypeAtSink(ir.types, ctorCall.in_method, flow.sink_line)
+                : undefined;
+            const relatedCalleeFiles = javaRelatedCalleeFiles(projectGraph, fa.file, hostType);
+            return projectCallerPassesShellArgvForWrapper(varName, ctorCall.in_method, flow.sink_line, ir.types, ir.calls, lines, projectGraph, sourceLinesByFile, getCallerContext, cb => {
+                for (const calleeFile of relatedCalleeFiles) {
+                    forEachCrossFileCall(calleeFile, cb);
+                }
+            });
+        });
+    }
+}
 // ---------------------------------------------------------------------------
 // Stage 12 — Java throw-statement FP suppression.
 // (cognium-dev #157 — Sprint 45)
@@ -490,6 +1057,23 @@ const FETCH_MEMBER_RECEIVER_RE = /[\w$)\]]\s*\.\s*fetch\s*\(/;
 // unaffected.
 const NOSQL_ARRAY_METHODS = new Set(['find', 'filter', 'some', 'every', 'findIndex', 'findLast']);
 const FUNCTION_FIRST_ARG_RE = /\.\s*(?:find|filter|some|every|findIndex|findLast)\s*\(\s*(?:async\s+)?(?:function\b|(?:\([^()]*\)|[A-Za-z_$][\w$]*)\s*=>)/;
+// cognium-dev#1000 — `recv.find(name)` with a single bare identifier argument.
+const NAMED_ARRAY_PREDICATE_RE = /([A-Za-z_$][\w$]*)\s*\.\s*(find|filter|some|every|findIndex|findLast)\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+/** A function declared in this file under `name` (function / const arrow / function expression). */
+function isDeclaredFunctionName(name, lines) {
+    const n = name.replace(/[$]/g, '\\$');
+    const decls = [
+        new RegExp(`\\bfunction\\s+${n}\\s*[(<]`),
+        new RegExp(`\\b(?:const|let|var)\\s+${n}\\s*(?::[^=]*)?=\\s*(?:async\\s+)?(?:function\\b|\\(|[A-Za-z_$][\\w$]*\\s*=>)`),
+    ];
+    return lines.some(l => decls.some(re => re.test(l)));
+}
+/** `name` declared as an array in this file: `= [`, `: T[]`, `Array<…>`, `new Array`, `Array.from`. */
+function isDeclaredArrayName(name, lines) {
+    const n = name.replace(/[$]/g, '\\$');
+    const re = new RegExp(`\\b${n}\\s*(?:\\??\\s*:\\s*(?:readonly\\s+)?(?:[\\w$.<>,\\s]+\\[\\]|(?:Readonly)?Array\\s*<)|(?::[^=;]*)?=\\s*(?:\\[|new\\s+Array\\b|Array\\.(?:from|of)\\b))`);
+    return lines.some(l => re.test(l));
+}
 // cognium-ai#279 R-1 — an argument that is an object literal with an ORM
 // query-builder key (`where`/`select`/`populate`/…) is a *builder*, not a raw
 // query string: a value in a `{ field, value }` position binds as a parameter
@@ -519,6 +1103,23 @@ const SERVER_SIGNAL_RE = /["']use server["']|\b(?:getServerSideProps|getStaticPr
 const FIXED_HOST_TEMPLATE_RE = /`https?:\/\/[^/${}\s`]+[/`]/;
 /** A bash URL word whose scheme and host are literal and closed by `/` (#495). */
 const BASH_FIXED_HOST_URL_RE = /^(?:https?|ftp):\/\/[A-Za-z0-9.-]+(?::\d+)?\//;
+/** Rust `format!("https://host/{}", path)` — literal origin, path-only interpolation (#922). */
+const RUST_FIXED_HOST_FORMAT_RE = /format!\(\s*"https?:\/\/[^"{}]+\/\{\}"/;
+function rustSsrfRequestUsesFixedHostFormat(code, sinkLine) {
+    const lines = code.split('\n');
+    const sinkText = lines[sinkLine - 1] ?? '';
+    const argMatch = sinkText.match(/(?:reqwest::)?get\s*\(\s*&?(\w+)/);
+    if (!argMatch)
+        return false;
+    const varName = argMatch[1];
+    const assignRe = new RegExp(`\\blet\\s+${escapeRegex(varName)}\\s*=\\s*format!`);
+    for (let i = sinkLine - 2; i >= Math.max(0, sinkLine - 20); i--) {
+        const line = lines[i] ?? '';
+        if (assignRe.test(line) && RUST_FIXED_HOST_FORMAT_RE.test(line))
+            return true;
+    }
+    return false;
+}
 /**
  * True when the string literal that ended at `end` is the WHOLE initializer:
  * the next code token is `;`, `,`, end of input, or (ASI) a token on a later
@@ -817,7 +1418,10 @@ function isUnwrittenLocalMapKeyRead(code, source) {
         return false;
     const [, recv, key] = read;
     // (a) locally constructed map
-    const ctorRe = new RegExp(`\\b${recv}\\s*=\\s*new\\s+(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`);
+    const ctorRe = new RegExp(
+    // `new HashMap<>()` or the qualified `new java.util.HashMap<>()` (OWASP
+    // BenchmarkJava writes the qualified form throughout).
+    `\\b${recv}\\s*=\\s*new\\s+(?:java\\.util\\.(?:concurrent\\.)?)?(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`);
     if (!lines.some(l => ctorRe.test(l)))
         return false;
     // (b) no escape: the receiver must not appear inside any call's arguments.
@@ -831,10 +1435,11 @@ function isUnwrittenLocalMapKeyRead(code, source) {
         if (escapeRe.test(stripped))
             return false;
     }
-    // (c2) was this literal key ever written? If so, drop only a literal-only map.
+    // (c2) was this literal key ever written? If so, drop when that key's puts are
+    // all literals (#584 key-shuffle), even if another key holds tainted data.
     const putRe = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}"`);
     if (lines.some(l => putRe.test(l)))
-        return isLiteralOnlyLocalMap(lines, recv);
+        return isLiteralOnlyLocalMapKey(lines, recv, key);
     return true;
 }
 /**
@@ -847,6 +1452,51 @@ function isUnwrittenLocalMapKeyRead(code, source) {
  * a value out of sight. Combined with (a) local construction and (b) no escape
  * in the caller, a read of such a map yields a literal and is not a source.
  */
+/** Every `put` of `key` on `recv` stores a string literal (other keys ignored). */
+function isLiteralOnlyLocalMapKey(lines, recv, key) {
+    const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const otherMutator = new RegExp(`\\b${recv}\\s*\\.\\s*(?:putAll|putIfAbsent|compute|computeIfAbsent|computeIfPresent|merge|replace|replaceAll|entrySet|values)\\s*\\(`);
+    if (lines.some(l => otherMutator.test(l)))
+        return false;
+    const keyPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${escapedKey}"\\s*,\\s*"(?:[^"\\\\]|\\\\.)*"\\s*\\)`);
+    const anyKeyPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${escapedKey}"`);
+    let putsForKey = 0;
+    let literalPutsForKey = 0;
+    for (const l of lines) {
+        putsForKey += (l.match(anyKeyPut) ?? []).length;
+        literalPutsForKey += (l.match(keyPut) ?? []).length;
+    }
+    return putsForKey > 0 && putsForKey === literalPutsForKey;
+}
+/**
+ * cognium-dev#818 (src14) / #888 — `class: 'cache'` seeds `cache.get()` as db_input for
+ * redis `createClient()` bindings. Drop in-memory shapes: local `new Map()`, object
+ * property caches (`scope.cache.get`), and a bare `cache` variable not assigned from
+ * `createClient()`.
+ */
+function isJsDisguisedCacheDbInputRead(code, source) {
+    if (source.type !== 'db_input')
+        return false;
+    const loc = source.location ?? '';
+    if (!/\.cache\.get\s*\(/i.test(loc) && !/\bcache\.get\s*\(/i.test(loc))
+        return false;
+    const lines = code.split('\n');
+    const lineText = lines[source.line - 1] ?? '';
+    // In-object texture / loader caches: `scope.cache.get`, `this.cache.get`, etc.
+    if (/\w+\.cache\.get\s*\(/.test(lineText))
+        return true;
+    const read = /\b([A-Za-z_]\w*)\s*\.\s*get\s*\(/.exec(lineText);
+    if (!read)
+        return false;
+    const recv = read[1];
+    if (recv !== 'cache')
+        return false;
+    const mapCtor = new RegExp(`\\b${recv}\\s*=\\s*new\\s+(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`);
+    if (lines.some(l => mapCtor.test(l)))
+        return true;
+    const redisClient = new RegExp(`\\b${recv}\\s*=\\s*(?:await\\s+)?(?:redis\\.)?createClient\\s*\\(`);
+    return !lines.some(l => redisClient.test(l));
+}
 function isLiteralOnlyLocalMap(lines, recv) {
     const anyPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(`, 'g');
     const literalPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*(?:"(?:[^"\\\\]|\\\\.)*"|[A-Za-z_][\\w.]*)\\s*,\\s*"(?:[^"\\\\]|\\\\.)*"\\s*\\)`, 'g');
@@ -1396,7 +2046,9 @@ export class SinkFilterPass {
         // of a key that WAS put is also dropped when every value put on that local,
         // non-escaping map is a string literal (`isLiteralOnlyLocalMap`).
         const sources = ctx.code
-            ? executableSources.filter(s => !isUnwrittenLocalMapKeyRead(ctx.code, s))
+            ? executableSources
+                .filter(s => !isUnwrittenLocalMapKeyRead(ctx.code, s))
+                .filter(s => !isJsDisguisedCacheDbInputRead(ctx.code, s))
             : executableSources;
         // Build merged sinks, deduplicating JS DOM sinks that may overlap with config sinks.
         const sinks = [...taintMatcher.sinks];
@@ -1951,7 +2603,8 @@ export class SinkFilterPass {
                     // cognium-dev#626: a `List<String>` PARAMETER is argv-form only while no
                     // same-file caller hands it a shell argv (`/bin/sh -c <script>`): then
                     // the tainted element is the script, so the suppression proves nothing.
-                    if (isArgvContainerType(t) && !sameFileCallerPassesShellArgv(varName, ctorCall.in_method, ctorCall.location.line, irTypes, irCalls)) {
+                    // Cross-file shell-argv recall is restored in analyzeProject (#626).
+                    if (isArgvContainerType(t) && !sameFileCallerPassesShellArgv(varName, ctorCall.in_method, ctorCall.location.line, irTypes, irCalls, sourceLines)) {
                         return false;
                     }
                 }
@@ -2375,7 +3028,21 @@ export class SinkFilterPass {
                 if (!NOSQL_ARRAY_METHODS.has(sink.method ?? ''))
                     return true;
                 const sinkLineText = sourceLines[sink.line - 1] ?? '';
-                return !FUNCTION_FIRST_ARG_RE.test(sinkLineText);
+                if (FUNCTION_FIRST_ARG_RE.test(sinkLineText))
+                    return false;
+                // cognium-dev#1000 — `ancestors.find(meaningful)`: a named predicate
+                // declared as a function in this file, or a receiver declared as an
+                // array, is Array.prototype iteration too. A Mongo
+                // `collection.find(query)` with a query variable keeps firing.
+                const named = NAMED_ARRAY_PREDICATE_RE.exec(sinkLineText);
+                if (named) {
+                    const [, receiver, method, arg] = named;
+                    if (NOSQL_ARRAY_METHODS.has(method) &&
+                        (isDeclaredFunctionName(arg, sourceLines) || isDeclaredArrayName(receiver, sourceLines))) {
+                        return false;
+                    }
+                }
+                return true;
             });
         }
         // Stage 15h — JS/TS sql/nosql: ORM query-builder object argument.
@@ -2573,6 +3240,16 @@ export class SinkFilterPass {
                 return bodyCalls.length === 0 || !bodyCalls.every(rustBodyDeclaresNonHtmlType);
             });
         }
+        // Stage 15n — rust ssrf: format! with a literal origin and a single `{}` path
+        // slot (cognium-dev#922). Same intent as Stage 15i/15m: the host is fixed at
+        // compile time, so taint in the path cannot redirect the request.
+        if (language === 'rust') {
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'ssrf')
+                    return true;
+                return !rustSsrfRequestUsesFixedHostFormat(ctx.code, sink.line);
+            });
+        }
         // Stage 15m — bash ssrf: fixed-host URL word (cognium-dev#495, #669).
         // The bash analogue of Stage 15i: `curl -- "https://api.example.com/${p}"`
         // can only reach the literal host, whatever `$p` holds. Every word on the
@@ -3290,7 +3967,8 @@ export function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg
         // same line (e.g. System.getProperty("user.dir") inside r.exec(args,...,new File(...))).
         // sink.method is set by findSinks to call.method_name; language-sources sinks also carry it.
         const relevantCalls = sink.method
-            ? callsAtSink.filter(c => c.method_name === sink.method)
+            ? callsAtSink.filter(c => c.method_name === sink.method &&
+                (sink.callColumn === undefined || c.location.column === sink.callColumn))
             : callsAtSink;
         // Whether to trust sink.argPositions for narrowing the cleanness check. In shell-like
         // languages, flag-vs-positional ambiguity makes statically declared argument positions