circle-ir 4.16.1 → 4.18.1

package/dist/analysis/passes/tls-verify-disabled-pass.d.ts

@@ -12,6 +12,9 @@
  *       call/composite contains literal `InsecureSkipVerify: true`, OR via
  *       a syntactic text scan (composite literals are not always emitted
  *       as calls in IR).
+ *     - `(*x509.Certificate).Verify` with `x509.VerifyOptions` and no
+ *       intermediate-CA denylist / blocklist guard in the same file — PKIX
+ *       chain acceptance without checking blocked intermediates (CWE-295).
  *   Python:
  *     - `requests.get|post|put|delete|patch|head|options|request(..., verify=False)`
  *     - `ssl._create_unverified_context()` / `ssl._create_default_https_context = ssl._create_unverified_context`
@@ -21,6 +24,17 @@
  *     - `{ rejectUnauthorized: false }` in https.request / fetch options /
  *       node-fetch / axios — text scan on arg expressions
  *     - `https.Agent({ rejectUnauthorized: false })`
+ *     - Custom `checkServerIdentity` that always succeeds (`=> undefined` /
+ *       `=> null` / empty body) — disables hostname verification without
+ *       setting `rejectUnauthorized: false`
+ *     - Custom `checkServerIdentity` that accepts after loose host parsing
+ *       (digit-only IP folding, helper such as `looseIp`) — CWE-295 weak identity
+ *     - Custom `checkServerIdentity` that compares hosts after Unicode NFKC
+ *       normalization (fullwidth / homograph confusion)
+ *     - Custom `checkServerIdentity` that accepts when the requested host
+ *       appears in subjectAltName / DNS SAN text (DNS↔IP confusion)
+ *     - Custom `checkServerIdentity` that walks `issuerCertificate` without
+ *       an intermediate denylist / blocklist guard
  *     - `process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'` (assignment;
  *       detected via call to property assignment — best-effort)
  *   Java:
@@ -47,6 +61,10 @@ export declare class TlsVerifyDisabledPass implements AnalysisPass<TlsVerifyDisa
     run(ctx: PassContext): TlsVerifyDisabledResult;
     private detectCall;
     private detectSourceText;
+    /** Standalone and inline `checkServerIdentity` with weak identity checks. */
+    private detectWeakCheckServerIdentityCallbacks;
+    private classifyWeakCheckServerIdentityBody;
+    private sliceBalancedBraces;
     private fixFor;
 }
 //# sourceMappingURL=tls-verify-disabled-pass.d.ts.map

package/dist/analysis/passes/tls-verify-disabled-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tls-verify-disabled-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/tls-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA6B9E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,qBAAsB,YAAW,YAAY,CAAC,uBAAuB,CAAC;IACjF,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,uBAAuB,CA2D7C;IAED,OAAO,CAAC,UAAU;IA4ElB,OAAO,CAAC,gBAAgB;IAuExB,OAAO,CAAC,MAAM;CAiCf"}
+{"version":3,"file":"tls-verify-disabled-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/tls-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqD9E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,qBAAsB,YAAW,YAAY,CAAC,uBAAuB,CAAC;IACjF,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,uBAAuB,CA2D7C;IAED,OAAO,CAAC,UAAU;IA4ElB,OAAO,CAAC,gBAAgB;IAyHxB,6EAA6E;IAC7E,OAAO,CAAC,sCAAsC;IAwC9C,OAAO,CAAC,mCAAmC;IAoC3C,OAAO,CAAC,mBAAmB;IAc3B,OAAO,CAAC,MAAM;CA2Cf"}

package/dist/analysis/passes/tls-verify-disabled-pass.js

@@ -12,6 +12,9 @@
  *       call/composite contains literal `InsecureSkipVerify: true`, OR via
  *       a syntactic text scan (composite literals are not always emitted
  *       as calls in IR).
+ *     - `(*x509.Certificate).Verify` with `x509.VerifyOptions` and no
+ *       intermediate-CA denylist / blocklist guard in the same file — PKIX
+ *       chain acceptance without checking blocked intermediates (CWE-295).
  *   Python:
  *     - `requests.get|post|put|delete|patch|head|options|request(..., verify=False)`
  *     - `ssl._create_unverified_context()` / `ssl._create_default_https_context = ssl._create_unverified_context`
@@ -21,6 +24,17 @@
  *     - `{ rejectUnauthorized: false }` in https.request / fetch options /
  *       node-fetch / axios — text scan on arg expressions
  *     - `https.Agent({ rejectUnauthorized: false })`
+ *     - Custom `checkServerIdentity` that always succeeds (`=> undefined` /
+ *       `=> null` / empty body) — disables hostname verification without
+ *       setting `rejectUnauthorized: false`
+ *     - Custom `checkServerIdentity` that accepts after loose host parsing
+ *       (digit-only IP folding, helper such as `looseIp`) — CWE-295 weak identity
+ *     - Custom `checkServerIdentity` that compares hosts after Unicode NFKC
+ *       normalization (fullwidth / homograph confusion)
+ *     - Custom `checkServerIdentity` that accepts when the requested host
+ *       appears in subjectAltName / DNS SAN text (DNS↔IP confusion)
+ *     - Custom `checkServerIdentity` that walks `issuerCertificate` without
+ *       an intermediate denylist / blocklist guard
  *     - `process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'` (assignment;
  *       detected via call to property assignment — best-effort)
  *   Java:
@@ -43,6 +57,14 @@ const PY_HTTP_RECEIVERS = new Set([
 const VERIFY_FALSE_RE = /\bverify\s*=\s*False\b/;
 const REJECT_UNAUTHORIZED_FALSE_RE = /\brejectUnauthorized\s*:\s*false\b/;
 const INSECURE_SKIP_VERIFY_TRUE_RE = /\bInsecureSkipVerify\s*:\s*true\b/;
+const GO_X509_VERIFY_CALL_RE = /\.Verify\s*\(/;
+const GO_INTERMEDIATE_DENYLIST_GUARD_RE = /\b(denylist|denyList|deny_list|blocklist|blockList|blockedIntermediate|blocked_intermediate|deniedIntermediate|deniedIntermediates|denied_intermediate|isDeniedIntermediate|intermediateDenylist|intermediate_denylist)\b/i;
+/** Strip Go comments so denylist words in headers do not suppress x509.Verify findings. */
+function goSourceWithoutComments(code) {
+    let s = code.replace(/\/\*[\s\S]*?\*\//g, ' ');
+    s = s.replace(/\/\/[^\n]*/g, ' ');
+    return s;
+}
 const HOSTNAME_LAMBDA_TRUE_RE = /\(\s*\w+\s*,\s*\w+\s*\)\s*->\s*true\b/;
 // C#: a cert-validation callback given an always-true lambda — assigned
 // (`= `/`+= `) or wrapped in a delegate constructor (`new …Callback( … )`).
@@ -55,6 +77,15 @@ const ALLOW_ALL_HOSTNAME_VERIFIERS = new Set([
     'new AllowAllHostnameVerifier()',
     'new NoopHostnameVerifier()',
 ]);
+// Node TLS: returning undefined/null from checkServerIdentity means success.
+const JS_CHECK_SERVER_IDENTITY_NOP_RE = /\bcheckServerIdentity\s*:\s*(?:async\s*)?\([^)]*\)\s*=>\s*(?:undefined|null)\b/;
+const JS_CHECK_SERVER_IDENTITY_NOP_FN_RE = /\bcheckServerIdentity\s*:\s*function\s*\([^)]*\)\s*\{\s*return\s+(?:undefined|null)\s*;?\s*\}/;
+const JS_CHECK_SERVER_IDENTITY_DECL_RE = /\bfunction\s+checkServerIdentity\s*\([^)]*\)\s*\{/g;
+const JS_LOOSE_IP_HOST_STRIP_RE = /\.replace\s*\(\s*\/\[\^\\d\.\]\\]\//;
+const JS_CHECK_SERVER_IDENTITY_LOOSE_BODY_RE = /(?:looseIp\s*\(|\.replace\s*\(\s*\/\[\^\\d\.\]\\]\/)[\s\S]*?return\s+undefined\b/;
+const JS_NFKC_NORMALIZE_RE = /\.normalize\s*\(\s*['"]NFKC['"]\s*\)/i;
+const JS_SUBJECT_ALT_NAME_RE = /\bsubjectaltname\b|\bsubjectAltName\b|\baltNames\b|\bDNS:\b|\bIP Address:/i;
+const JS_ISSUER_CHAIN_WALK_RE = /\bissuerCertificate\b/;
 export class TlsVerifyDisabledPass {
     name = 'tls-verify-disabled';
     category = 'security';
@@ -195,6 +226,21 @@ export class TlsVerifyDisabledPass {
                     });
                 }
             }
+            if (/\bx509\./.test(code) &&
+                /\bVerifyOptions\b/.test(code) &&
+                GO_X509_VERIFY_CALL_RE.test(code) &&
+                !GO_INTERMEDIATE_DENYLIST_GUARD_RE.test(goSourceWithoutComments(code))) {
+                for (let i = 0; i < lines.length; i++) {
+                    if (GO_X509_VERIFY_CALL_RE.test(lines[i])) {
+                        out.push({
+                            line: i + 1,
+                            pattern: 'x509.Verify without intermediate denylist',
+                            api: 'x509.Certificate.Verify',
+                        });
+                        break;
+                    }
+                }
+            }
         }
         if (language === 'python') {
             for (let i = 0; i < lines.length; i++) {
@@ -218,6 +264,37 @@ export class TlsVerifyDisabledPass {
                         api: 'process.env',
                     });
                 }
+                if (JS_CHECK_SERVER_IDENTITY_NOP_RE.test(l) ||
+                    JS_CHECK_SERVER_IDENTITY_NOP_FN_RE.test(l)) {
+                    out.push({
+                        line: i + 1,
+                        pattern: 'checkServerIdentity => undefined',
+                        api: 'tls.connect / https.request options',
+                    });
+                }
+            }
+            // Multi-line arrow bodies (options object spans lines).
+            const m = JS_CHECK_SERVER_IDENTITY_NOP_RE.exec(code) ?? JS_CHECK_SERVER_IDENTITY_NOP_FN_RE.exec(code);
+            if (m && m.index !== undefined) {
+                const line = code.slice(0, m.index).split('\n').length;
+                const dupKey = `${line}-checkServerIdentity => undefined`;
+                if (!out.some((o) => `${o.line}-${o.pattern}` === dupKey)) {
+                    out.push({
+                        line,
+                        pattern: 'checkServerIdentity => undefined',
+                        api: 'tls.connect / https.request options',
+                    });
+                }
+            }
+            for (const weak of this.detectWeakCheckServerIdentityCallbacks(code)) {
+                const dupKey = `${weak.line}-${weak.pattern}`;
+                if (!out.some((o) => `${o.line}-${o.pattern}` === dupKey)) {
+                    out.push({
+                        line: weak.line,
+                        pattern: weak.pattern,
+                        api: 'checkServerIdentity (custom)',
+                    });
+                }
             }
         }
         if (language === 'csharp') {
@@ -244,12 +321,91 @@ export class TlsVerifyDisabledPass {
         }
         return out;
     }
+    /** Standalone and inline `checkServerIdentity` with weak identity checks. */
+    detectWeakCheckServerIdentityCallbacks(code) {
+        const hits = [];
+        const fileHasDenylist = GO_INTERMEDIATE_DENYLIST_GUARD_RE.test(code);
+        const declRe = new RegExp(JS_CHECK_SERVER_IDENTITY_DECL_RE.source, 'g');
+        let match;
+        while ((match = declRe.exec(code)) !== null) {
+            const openBrace = code.indexOf('{', match.index);
+            if (openBrace < 0)
+                continue;
+            const body = this.sliceBalancedBraces(code, openBrace);
+            if (!body)
+                continue;
+            const prelude = code.slice(Math.max(0, match.index - 800), match.index);
+            const line = code.slice(0, match.index).split('\n').length;
+            const weak = this.classifyWeakCheckServerIdentityBody(body, prelude, fileHasDenylist);
+            if (weak)
+                hits.push({ line, pattern: weak });
+        }
+        const inlineRe = /\bcheckServerIdentity\s*:\s*(?:async\s*)?function\s*\([^)]*\)\s*\{/g;
+        while ((match = inlineRe.exec(code)) !== null) {
+            const openBrace = code.indexOf('{', match.index);
+            if (openBrace < 0)
+                continue;
+            const body = this.sliceBalancedBraces(code, openBrace);
+            if (!body)
+                continue;
+            const prelude = code.slice(Math.max(0, match.index - 800), match.index);
+            const line = code.slice(0, match.index).split('\n').length;
+            const weak = this.classifyWeakCheckServerIdentityBody(body, prelude, fileHasDenylist);
+            if (weak)
+                hits.push({ line, pattern: weak });
+        }
+        return hits;
+    }
+    classifyWeakCheckServerIdentityBody(body, prelude, fileHasDenylist) {
+        if (!/\breturn\s+undefined\b/.test(body))
+            return null;
+        const loose = JS_LOOSE_IP_HOST_STRIP_RE.test(body) ||
+            JS_LOOSE_IP_HOST_STRIP_RE.test(prelude) ||
+            /\blooseIp\s*\(/.test(body);
+        if (loose && JS_CHECK_SERVER_IDENTITY_LOOSE_BODY_RE.test(body)) {
+            return 'checkServerIdentity loose host parse => undefined';
+        }
+        const nfkc = JS_NFKC_NORMALIZE_RE.test(body) || JS_NFKC_NORMALIZE_RE.test(prelude);
+        if (nfkc && /\breturn\s+undefined\b/.test(body)) {
+            return 'checkServerIdentity NFKC host normalize => undefined';
+        }
+        if (JS_SUBJECT_ALT_NAME_RE.test(body) && /\breturn\s+undefined\b/.test(body)) {
+            return 'checkServerIdentity DNS SAN / IP match => undefined';
+        }
+        if (JS_ISSUER_CHAIN_WALK_RE.test(body) &&
+            !fileHasDenylist &&
+            /\breturn\s+undefined\b/.test(body)) {
+            return 'checkServerIdentity issuer chain without denylist => undefined';
+        }
+        return null;
+    }
+    sliceBalancedBraces(code, openIndex) {
+        if (code[openIndex] !== '{')
+            return null;
+        let depth = 0;
+        for (let i = openIndex; i < code.length; i++) {
+            const ch = code[i];
+            if (ch === '{')
+                depth++;
+            else if (ch === '}') {
+                depth--;
+                if (depth === 0)
+                    return code.slice(openIndex, i + 1);
+            }
+        }
+        return null;
+    }
     fixFor(language, pattern) {
         if (pattern.includes('InsecureSkipVerify')) {
             return 'Remove `InsecureSkipVerify: true` — let Go verify the cert. If ' +
                 'you need to trust a private CA, set `RootCAs` to a `*x509.CertPool` ' +
                 'containing that CA.';
         }
+        if (pattern.includes('x509.Verify without intermediate denylist')) {
+            return 'Before calling `x509.Certificate.Verify`, check the chain (including ' +
+                'intermediates) against your blocked-CA / denylist policy. Relying on PKIX ' +
+                'verification alone accepts chains that include revoked or blocked intermediates.';
+        }
         if (pattern.includes('verify=False')) {
             return 'Remove `verify=False`. To trust a private CA, pass `verify=\'/path/to/ca.pem\'`.';
         }
@@ -257,6 +413,11 @@ export class TlsVerifyDisabledPass {
             return 'Remove `rejectUnauthorized: false`. To trust a private CA, set the ' +
                 '`ca` option to the CA cert(s). Never disable TLS verification globally.';
         }
+        if (pattern.includes('checkServerIdentity')) {
+            return 'Implement `checkServerIdentity` to compare the certificate to the ' +
+                'intended hostname (or remove the override). Returning `undefined` accepts ' +
+                'the connection; loose host/IP folding before that check enables MITM.';
+        }
         if (pattern.includes('NODE_TLS_REJECT_UNAUTHORIZED')) {
             return 'Remove the `NODE_TLS_REJECT_UNAUTHORIZED=0` assignment — it globally ' +
                 'disables TLS verification for every outbound HTTPS request.';

package/dist/analysis/passes/tls-verify-disabled-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"tls-verify-disabled-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/tls-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,iEAAiE;AACjE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;IACrE,MAAM;CACP,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,MAAM,4BAA4B,GAAG,oCAAoC,CAAC;AAC1E,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AACzE,MAAM,uBAAuB,GAAG,uCAAuC,CAAC;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,sCAAsC;AACtC,MAAM,wBAAwB,GAC5B,gMAAgM,CAAC;AACnM,MAAM,sBAAsB,GAAG,kDAAkD,CAAC;AAClF,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,+BAA+B;IAC/B,gCAAgC;IAChC,4BAA4B;CAC7B,CAAC,CAAC;AAWH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,qBAAqB,CAAC;IAC7B,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAwC,EAAE,CAAC;QAEzD,kEAAkE;QAClE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YAE1C,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,OAAO;gBACd,OAAO,EACL,+CAA+C,GAAG,CAAC,OAAO,QAAQ;oBAClE,KAAK,GAAG,CAAC,GAAG,kDAAkD;oBAC9D,mEAAmE;oBACnE,+BAA+B;gBACjC,IAAI;gBACJ,IAAI;gBACJ,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC;gBACvC,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,wCAAwC;QACxC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,MAAM,CAAC;gBAAE,SAAS;YACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtC,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;gBACzD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,OAAO;gBACd,OAAO,EACL,+CAA+C,KAAK,CAAC,OAAO,KAAK;oBACjE,IAAI,KAAK,CAAC,GAAG,4CAA4C;gBAC3D,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;gBACzC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,IAAc,EAAE,QAAgB;QAIjD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,uCAAuC;YACvC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC3C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC;YACD,mCAAmC;YACnC,IAAI,MAAM,KAAK,4BAA4B,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAClE,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,GAAG,EAAE,kCAAkC,EAAE,CAAC;YAChG,CAAC;YACD,+EAA+E;YAC/E,IAAI,QAAQ,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;wBAC/C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;oBAC1D,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,4EAA4E;YAC5E,4EAA4E;YAC5E,wEAAwE;YACxE,mCAAmC;YACnC,EAAE;YACF,+DAA+D;YAC/D,6EAA6E;YAC7E,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9E,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBAC7D,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO;gBAC/D,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC;YACvE,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,IAAI,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;wBAC5D,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,UAAU,IAAI,MAAM,EAAE,EAAE,CAAC;oBAC9F,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,+CAA+C;YAC/C,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;gBACzD,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;gBAClE,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,4BAA4B,EAAE,CAAC;oBAC7C,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;wBACrE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,IAAY,EAAE,QAAgB;QAGrD,MAAM,GAAG,GAA0D,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,wEAAwE;YACxE,8CAA8C;YAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,0BAA0B;wBACnC,GAAG,EAAE,YAAY;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,0EAA0E,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvF,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,gEAAgE;wBACzE,GAAG,EAAE,qBAAqB;qBAC3B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,4DAA4D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,gCAAgC;wBACzC,GAAG,EAAE,aAAa;qBACnB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,uEAAuE;YACvE,sFAAsF;YACtF,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC3C,IAAI,CAAC,EAAE,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnE,CAAC;qBAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,8CAA8C;wBACvD,GAAG,EAAE,mBAAmB;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,MAAM,CAAC,QAAgB,EAAE,OAAe;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,OAAO,iEAAiE;gBACtE,sEAAsE;gBACtE,qBAAqB,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,OAAO,kFAAkF,CAAC;QAC5F,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,OAAO,qEAAqE;gBAC1E,yEAAyE,CAAC;QAC9E,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;YACrD,OAAO,uEAAuE;gBAC5E,6DAA6D,CAAC;QAClE,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,0EAA0E;gBAC/E,2EAA2E;gBAC3E,+CAA+C,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACvD,OAAO,gFAAgF,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,qEAAqE;gBAC1E,6EAA6E;gBAC7E,4EAA4E;gBAC5E,yCAAyC,CAAC;QAC9C,CAAC;QACD,OAAO,oDAAoD,CAAC;IAC9D,CAAC;CACF"}
+{"version":3,"file":"tls-verify-disabled-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/tls-verify-disabled-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAKH,iEAAiE;AACjE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS;IACrE,MAAM;CACP,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,MAAM,4BAA4B,GAAG,oCAAoC,CAAC;AAC1E,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AACzE,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAC/C,MAAM,iCAAiC,GACrC,4NAA4N,CAAC;AAE/N,2FAA2F;AAC3F,SAAS,uBAAuB,CAAC,IAAY;IAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AACD,MAAM,uBAAuB,GAAG,uCAAuC,CAAC;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,sCAAsC;AACtC,MAAM,wBAAwB,GAC5B,gMAAgM,CAAC;AACnM,MAAM,sBAAsB,GAAG,kDAAkD,CAAC;AAClF,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,+BAA+B;IAC/B,gCAAgC;IAChC,4BAA4B;CAC7B,CAAC,CAAC;AACH,6EAA6E;AAC7E,MAAM,+BAA+B,GACnC,gFAAgF,CAAC;AACnF,MAAM,kCAAkC,GACtC,+FAA+F,CAAC;AAClG,MAAM,gCAAgC,GACpC,oDAAoD,CAAC;AACvD,MAAM,yBAAyB,GAAG,qCAAqC,CAAC;AACxE,MAAM,sCAAsC,GAC1C,kFAAkF,CAAC;AACrF,MAAM,oBAAoB,GAAG,uCAAuC,CAAC;AACrE,MAAM,sBAAsB,GAC1B,4EAA4E,CAAC;AAC/E,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAWxD,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,qBAAqB,CAAC;IAC7B,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAwC,EAAE,CAAC;QAEzD,kEAAkE;QAClE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;YAE1C,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,OAAO;gBACd,OAAO,EACL,+CAA+C,GAAG,CAAC,OAAO,QAAQ;oBAClE,KAAK,GAAG,CAAC,GAAG,kDAAkD;oBAC9D,mEAAmE;oBACnE,+BAA+B;gBACjC,IAAI;gBACJ,IAAI;gBACJ,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC;gBACvC,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,wCAAwC;QACxC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,MAAM,CAAC;gBAAE,SAAS;YACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtC,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;gBACzD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,OAAO;gBACd,OAAO,EACL,+CAA+C,KAAK,CAAC,OAAO,KAAK;oBACjE,IAAI,KAAK,CAAC,GAAG,4CAA4C;gBAC3D,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;gBACzC,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,IAAc,EAAE,QAAgB;QAIjD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,uCAAuC;YACvC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC3C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC;YACD,mCAAmC;YACnC,IAAI,MAAM,KAAK,4BAA4B,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;gBAClE,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,GAAG,EAAE,kCAAkC,EAAE,CAAC;YAChG,CAAC;YACD,+EAA+E;YAC/E,IAAI,QAAQ,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;wBAC/C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;oBAC1D,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,4EAA4E;YAC5E,4EAA4E;YAC5E,wEAAwE;YACxE,mCAAmC;YACnC,EAAE;YACF,+DAA+D;YAC/D,6EAA6E;YAC7E,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9E,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBAC7D,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO;gBAC/D,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,QAAQ,CAAC;YACvE,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACjC,IAAI,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;wBAC5D,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,UAAU,IAAI,MAAM,EAAE,EAAE,CAAC;oBAC9F,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,+CAA+C;YAC/C,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;gBACzD,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;gBAClE,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,4BAA4B,EAAE,CAAC;oBAC7C,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;wBACrE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,IAAY,EAAE,QAAgB;QAGrD,MAAM,GAAG,GAA0D,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,wEAAwE;YACxE,8CAA8C;YAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,0BAA0B;wBACnC,GAAG,EAAE,YAAY;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IACE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBACrB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9B,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;gBACjC,CAAC,iCAAiC,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,EACtE,CAAC;gBACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1C,GAAG,CAAC,IAAI,CAAC;4BACP,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,OAAO,EAAE,2CAA2C;4BACpD,GAAG,EAAE,yBAAyB;yBAC/B,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,0EAA0E,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvF,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,gEAAgE;wBACzE,GAAG,EAAE,qBAAqB;qBAC3B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,4DAA4D,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,gCAAgC;wBACzC,GAAG,EAAE,aAAa;qBACnB,CAAC,CAAC;gBACL,CAAC;gBACD,IACE,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;oBACvC,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,EAC1C,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,kCAAkC;wBAC3C,GAAG,EAAE,qCAAqC;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,wDAAwD;YACxD,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;gBACvD,MAAM,MAAM,GAAG,GAAG,IAAI,mCAAmC,CAAC;gBAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI;wBACJ,OAAO,EAAE,kCAAkC;wBAC3C,GAAG,EAAE,qCAAqC;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,GAAG,EAAE,8BAA8B;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,uEAAuE;YACvE,sFAAsF;YACtF,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC3C,IAAI,CAAC,EAAE,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnE,CAAC;qBAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,8CAA8C;wBACvD,GAAG,EAAE,mBAAmB;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,6EAA6E;IACrE,sCAAsC,CAAC,IAAY;QAIzD,MAAM,IAAI,GAA6C,EAAE,CAAC;QAC1D,MAAM,eAAe,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,gCAAgC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACxE,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,SAAS,GAAG,CAAC;gBAAE,SAAS;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,mCAAmC,CACnD,IAAI,EAAE,OAAO,EAAE,eAAe,CAC/B,CAAC;YACF,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GACZ,qEAAqE,CAAC;QACxE,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACjD,IAAI,SAAS,GAAG,CAAC;gBAAE,SAAS;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,mCAAmC,CACnD,IAAI,EAAE,OAAO,EAAE,eAAe,CAC/B,CAAC;YACF,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,mCAAmC,CACzC,IAAY,EACZ,OAAe,EACf,eAAwB;QAExB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtD,MAAM,KAAK,GACT,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;YACvC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK,IAAI,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/D,OAAO,mDAAmD,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GACR,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO,sDAAsD,CAAC;QAChE,CAAC;QAED,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,OAAO,qDAAqD,CAAC;QAC/D,CAAC;QAED,IACE,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,eAAe;YAChB,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EACnC,CAAC;YACD,OAAO,gEAAgE,CAAC;QAC1E,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,mBAAmB,CAAC,IAAY,EAAE,SAAiB;QACzD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,QAAgB,EAAE,OAAe;QAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,OAAO,iEAAiE;gBACtE,sEAAsE;gBACtE,qBAAqB,CAAC;QAC1B,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,2CAA2C,CAAC,EAAE,CAAC;YAClE,OAAO,uEAAuE;gBAC5E,4EAA4E;gBAC5E,kFAAkF,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,OAAO,kFAAkF,CAAC;QAC5F,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC3C,OAAO,qEAAqE;gBAC1E,yEAAyE,CAAC;QAC9E,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC5C,OAAO,oEAAoE;gBACzE,4EAA4E;gBAC5E,uEAAuE,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;YACrD,OAAO,uEAAuE;gBAC5E,6DAA6D,CAAC;QAClE,CAAC;QACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,0EAA0E;gBAC/E,2EAA2E;gBAC3E,+CAA+C,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;YACvD,OAAO,gFAAgF,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,qEAAqE;gBAC1E,6EAA6E;gBAC7E,4EAA4E;gBAC5E,yCAAyC,CAAC;QAC9C,CAAC;QACD,OAAO,oDAAoD,CAAC;IAC9D,CAAC;CACF"}

package/dist/analysis/passes/weak-random-pass.d.ts

@@ -22,6 +22,8 @@
  *       `random.seed(...)`
  *   JavaScript / TypeScript:
  *     - `Math.random()`
+ *     - `crypto.randomUUID()` (or a bare `randomUUID` import) at module scope —
+ *       a single value captured at load and reused is not fresh entropy (CWE-330).
  *   Go:
  *     - `math/rand` package calls — `rand.Int()`, `Intn()`, `Float64()`, etc.
  *       (Note: we check the bare receiver `rand`; the `crypto/rand` package
@@ -53,6 +55,10 @@ export declare class WeakRandomPass implements AnalysisPass<WeakRandomResult> {
      * file (i.e. `math/rand` imported unaliased; `crypto/rand` is either not
      * imported or imported under an alias).
      */
+    /**
+     * Module-scoped `crypto.randomUUID()` / `randomUUID()` — entropy fixed at load.
+     */
+    private jsIsModuleScopedCryptoRandomUuid;
     private goMathRandIsActive;
 }
 //# sourceMappingURL=weak-random-pass.d.ts.map

package/dist/analysis/passes/weak-random-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"weak-random-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAiCtC;IAED,OAAO,CAAC,MAAM;IAqBd,OAAO,CAAC,MAAM;IA4Ed;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAiBjC;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;CAiB3B"}
+{"version":3,"file":"weak-random-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAiCtC;IAED,OAAO,CAAC,MAAM;IAqBd,OAAO,CAAC,MAAM;IA+Ed;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAiBjC;;;;OAIG;IACH;;OAEG;IACH,OAAO,CAAC,gCAAgC;IAkBxC,OAAO,CAAC,kBAAkB;CAiB3B"}

package/dist/analysis/passes/weak-random-pass.js

@@ -22,6 +22,8 @@
  *       `random.seed(...)`
  *   JavaScript / TypeScript:
  *     - `Math.random()`
+ *     - `crypto.randomUUID()` (or a bare `randomUUID` import) at module scope —
+ *       a single value captured at load and reused is not fresh entropy (CWE-330).
  *   Go:
  *     - `math/rand` package calls — `rand.Int()`, `Intn()`, `Float64()`, etc.
  *       (Note: we check the bare receiver `rand`; the `crypto/rand` package
@@ -158,6 +160,9 @@ export class WeakRandomPass {
             if (method === 'random' && (receiver === 'Math' || receiver.endsWith('.Math'))) {
                 return 'Math.random';
             }
+            if (this.jsIsModuleScopedCryptoRandomUuid(call, ctx)) {
+                return 'crypto.randomUUID (module scope)';
+            }
             return null;
         }
         if (language === 'go') {
@@ -202,6 +207,30 @@ export class WeakRandomPass {
      * file (i.e. `math/rand` imported unaliased; `crypto/rand` is either not
      * imported or imported under an alias).
      */
+    /**
+     * Module-scoped `crypto.randomUUID()` / `randomUUID()` — entropy fixed at load.
+     */
+    jsIsModuleScopedCryptoRandomUuid(call, ctx) {
+        if (call.method_name !== 'randomUUID')
+            return false;
+        if (call.in_method != null && call.in_method !== '')
+            return false;
+        const receiver = call.receiver ?? '';
+        if (receiver === 'crypto' || receiver.endsWith('.crypto'))
+            return true;
+        if (!receiver) {
+            const imports = ctx.graph.ir.imports ?? [];
+            return imports.some((imp) => {
+                const pkg = imp.from_package ?? '';
+                if (pkg !== 'crypto' && pkg !== 'node:crypto')
+                    return false;
+                const name = imp.imported_name ?? imp.alias ?? '';
+                const alias = imp.alias ?? imp.imported_name ?? '';
+                return name === 'randomUUID' || alias === 'randomUUID';
+            });
+        }
+        return false;
+    }
     goMathRandIsActive(ctx) {
         const imports = ctx.graph.ir.imports ?? [];
         let mathRandUnaliased = false;

package/dist/analysis/passes/weak-random-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"weak-random-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO;AACP,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa;IAC/D,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;CACxD,CAAC,CAAC;AAEH,iCAAiC;AACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa;IAClE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe;IAClE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY;IAC9D,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc;CACnE,CAAC,CAAC;AAEH,yBAAyB;AACzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACnD,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY;IACjD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IAC7C,MAAM,EAAE,KAAK,EAAE,WAAW;CAC3B,CAAC,CAAC;AAUH,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YAEvC,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,wCAAwC,GAAG,yBAAyB;oBACpE,uEAAuE;oBACvE,wEAAwE;gBAC1E,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACvB,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC7B,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,MAAM;gBACT,OAAO,6CAA6C;oBAClD,mFAAmF,CAAC;YACxF,KAAK,QAAQ;gBACX,OAAO,mDAAmD;oBACxD,8DAA8D,CAAC;YACnE,KAAK,YAAY,CAAC;YAClB,KAAK,YAAY,CAAC;YAClB,KAAK,KAAK;gBACR,OAAO,2CAA2C;oBAChD,iDAAiD,CAAC;YACtD,KAAK,IAAI;gBACP,OAAO,qDAAqD;oBAC1D,+EAA+E,CAAC;YACpF;gBACE,OAAO,6EAA6E,CAAC;QACzF,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAc,EAAE,QAAgB,EAAE,GAAgB;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,2CAA2C;YAC3C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,CAAC;gBACpB,IAAI,IAAI,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC;gBAC3C,IAAI,IAAI,KAAK,kBAAkB;oBAAE,OAAO,sBAAsB,CAAC;YACjE,CAAC;YACD,kBAAkB;YAClB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,kGAAkG;YAClG,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;gBACpC,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBACjE,kEAAkE;oBAClE,mEAAmE;oBACnE,oEAAoE;oBACpE,kBAAkB;oBAClB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,kBAAkB,IAAI,EAAE,KAAK,mBAAmB,EAAE,CAAC;oBAC/E,OAAO,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,kFAAkF;YAClF,sEAAsE;YACtE,0EAA0E;YAC1E,mEAAmE;YACnE,yCAAyC;YACzC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,cAAc,MAAM,EAAE,CAAC;gBACvE,IAAI,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,wBAAwB,MAAM,EAAE,CAAC;YAC7F,CAAC;YACD,6EAA6E;YAC7E,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvF,OAAO,6BAA6B,MAAM,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,iDAAiD;YACjD,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3F,OAAO,UAAU,MAAM,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACjF,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,kCAAkC;YAClC,IAAI,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,QAAQ,MAAM,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAAC,IAAc,EAAE,GAAgB;QAChE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,IAAI,IAAI,GAA8C,IAAI,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;oBAAE,SAAS;gBACvD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC;gBACvC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACxC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;gBACxD,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjG,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,GAAgB;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;QAC3C,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxD,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,IAAI,GAAG,KAAK,aAAa,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC1D,mBAAmB,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,wDAAwD;QACxD,OAAO,iBAAiB,IAAI,CAAC,mBAAmB,CAAC;IACnD,CAAC;CACF"}
+{"version":3,"file":"weak-random-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO;AACP,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa;IAC/D,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;CACxD,CAAC,CAAC;AAEH,iCAAiC;AACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa;IAClE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe;IAClE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY;IAC9D,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc;CACnE,CAAC,CAAC;AAEH,yBAAyB;AACzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACnD,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY;IACjD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IAC7C,MAAM,EAAE,KAAK,EAAE,WAAW;CAC3B,CAAC,CAAC;AAUH,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YAEvC,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,wCAAwC,GAAG,yBAAyB;oBACpE,uEAAuE;oBACvE,wEAAwE;gBAC1E,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACvB,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC7B,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,MAAM;gBACT,OAAO,6CAA6C;oBAClD,mFAAmF,CAAC;YACxF,KAAK,QAAQ;gBACX,OAAO,mDAAmD;oBACxD,8DAA8D,CAAC;YACnE,KAAK,YAAY,CAAC;YAClB,KAAK,YAAY,CAAC;YAClB,KAAK,KAAK;gBACR,OAAO,2CAA2C;oBAChD,iDAAiD,CAAC;YACtD,KAAK,IAAI;gBACP,OAAO,qDAAqD;oBAC1D,+EAA+E,CAAC;YACpF;gBACE,OAAO,6EAA6E,CAAC;QACzF,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAc,EAAE,QAAgB,EAAE,GAAgB;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,2CAA2C;YAC3C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,CAAC;gBACpB,IAAI,IAAI,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC;gBAC3C,IAAI,IAAI,KAAK,kBAAkB;oBAAE,OAAO,sBAAsB,CAAC;YACjE,CAAC;YACD,kBAAkB;YAClB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,kGAAkG;YAClG,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;gBACpC,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBACjE,kEAAkE;oBAClE,mEAAmE;oBACnE,oEAAoE;oBACpE,kBAAkB;oBAClB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,kBAAkB,IAAI,EAAE,KAAK,mBAAmB,EAAE,CAAC;oBAC/E,OAAO,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,kFAAkF;YAClF,sEAAsE;YACtE,0EAA0E;YAC1E,mEAAmE;YACnE,yCAAyC;YACzC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,cAAc,MAAM,EAAE,CAAC;gBACvE,IAAI,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,wBAAwB,MAAM,EAAE,CAAC;YAC7F,CAAC;YACD,6EAA6E;YAC7E,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvF,OAAO,6BAA6B,MAAM,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,iDAAiD;YACjD,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3F,OAAO,UAAU,MAAM,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACjF,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,IAAI,IAAI,CAAC,gCAAgC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACrD,OAAO,kCAAkC,CAAC;YAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,kCAAkC;YAClC,IAAI,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,QAAQ,MAAM,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAAC,IAAc,EAAE,GAAgB;QAChE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,IAAI,IAAI,GAA8C,IAAI,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;oBAAE,SAAS;gBACvD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC;gBACvC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACxC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;gBACxD,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjG,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH;;OAEG;IACK,gCAAgC,CAAC,IAAc,EAAE,GAAgB;QACvE,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QACpD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACrC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;YAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;gBACnC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,aAAa;oBAAE,OAAO,KAAK,CAAC;gBAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;gBACnD,OAAO,IAAI,KAAK,YAAY,IAAI,KAAK,KAAK,YAAY,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,kBAAkB,CAAC,GAAgB;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;QAC3C,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxD,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,IAAI,GAAG,KAAK,aAAa,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC1D,mBAAmB,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,wDAAwD;QACxD,OAAO,iBAAiB,IAAI,CAAC,mBAAmB,CAAC;IACnD,CAAC;CACF"}

package/dist/analysis/promote-cross-file-flows.d.ts

@@ -0,0 +1,17 @@
+/**
+ * cognium-dev#684 — mirror resolved cross-file taint paths onto the sink
+ * file's per-file `taint.flows` so project scans expose the same types in the
+ * per-file vulnerability list that `cross_file_taint_paths` already carries.
+ */
+import type { TaintFlowInfo, TaintPath } from '../types/index.js';
+type FileTaint = {
+    file: string;
+    analysis: {
+        taint: {
+            flows?: TaintFlowInfo[];
+        };
+    };
+};
+export declare function promoteCrossFilePathsToSinkFlows(fileAnalyses: FileTaint[], taintPaths: TaintPath[]): void;
+export {};
+//# sourceMappingURL=promote-cross-file-flows.d.ts.map

package/dist/analysis/promote-cross-file-flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promote-cross-file-flows.d.ts","sourceRoot":"","sources":["../../src/analysis/promote-cross-file-flows.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,aAAa,EAAiB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEjF,KAAK,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,KAAK,EAAE;YAAE,KAAK,CAAC,EAAE,aAAa,EAAE,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,CAAC;AAEpF,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,SAAS,EAAE,EACzB,UAAU,EAAE,SAAS,EAAE,GACtB,IAAI,CAkCN"}

package/dist/analysis/promote-cross-file-flows.js

@@ -0,0 +1,32 @@
+export function promoteCrossFilePathsToSinkFlows(fileAnalyses, taintPaths) {
+    for (const tp of taintPaths) {
+        if (!tp.path_exists || tp.source.file === tp.sink.file)
+            continue;
+        const fa = fileAnalyses.find(f => f.file === tp.sink.file);
+        if (!fa)
+            continue;
+        const flows = fa.analysis.taint.flows ?? [];
+        const exists = flows.some(f => f.sink_line === tp.sink.line
+            && f.sink_type === tp.sink.type
+            && f.source_line === tp.source.line
+            && f.source_type === tp.source.type);
+        if (exists)
+            continue;
+        const path = tp.hops.map((h, i) => ({
+            variable: h.variable,
+            line: h.line,
+            type: i === 0 ? 'source' : i === tp.hops.length - 1 ? 'sink' : 'use',
+        }));
+        flows.push({
+            source_line: tp.source.line,
+            sink_line: tp.sink.line,
+            source_type: tp.source.type,
+            sink_type: tp.sink.type,
+            path,
+            confidence: tp.confidence,
+            sanitized: false,
+        });
+        fa.analysis.taint.flows = flows;
+    }
+}
+//# sourceMappingURL=promote-cross-file-flows.js.map

package/dist/analysis/promote-cross-file-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promote-cross-file-flows.js","sourceRoot":"","sources":["../../src/analysis/promote-cross-file-flows.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,gCAAgC,CAC9C,YAAyB,EACzB,UAAuB;IAEvB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEjE,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,EAAE;YAAE,SAAS;QAElB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI;eACzB,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI;eAC5B,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI;eAChC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CACtC,CAAC;QACF,IAAI,MAAM;YAAE,SAAS;QAErB,MAAM,IAAI,GAAoB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;SACrE,CAAC,CAAC,CAAC;QAEJ,KAAK,CAAC,IAAI,CAAC;YACT,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI;YAC3B,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI;YACvB,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI;YAC3B,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI;YACvB,IAAI;YACJ,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/analysis/rust-literal-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust-literal-guard.d.ts","sourceRoot":"","sources":["../../src/analysis/rust-literal-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA6JxD,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CA2HrF"}
+{"version":3,"file":"rust-literal-guard.d.ts","sourceRoot":"","sources":["../../src/analysis/rust-literal-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAqPxD,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CA2HrF"}

package/dist/analysis/rust-literal-guard.js

@@ -179,6 +179,105 @@ function passesMutParam(line, n) {
     // Exclude method calls on name itself (`name.foo(`), handled by firstRebind.
     return !new RegExp(String.raw `\b${n}\s*\.\s*\w+\s*\(`).test(line) || new RegExp(String.raw `(?<![\w.])\w+\s*\(\s*${n}\b`).test(line);
 }
+/** `let bound = if <allowlist contains var> { var } else { <literal-only> };` */
+function findRustAllowlistTernarySanitizers(code) {
+    const masked = maskRust(code);
+    const origLines = code.split('\n');
+    const maskedLines = masked.split('\n');
+    const out = [];
+    const allowlistVar = (cond) => {
+        const c = cond.trim();
+        let m = new RegExp(String.raw `^!?(\w+)\s*\.\s*contains\s*\(\s*&\s*(\w+)(?:\s*\.\s*as_str\s*\(\s*\))?\s*\)$`).exec(c);
+        if (m)
+            return m[2];
+        if ((m = new RegExp(String.raw `^!\s*\[\s*${STR}(?:\s*,\s*${STR})*\s*,?\s*\]\s*\.\s*contains\s*\(\s*&\s*${VAR}\s*\)$`).exec(c))) {
+            return m[1];
+        }
+        return guardedVariable(c);
+    };
+    const LITERAL_CHAIN = new Set(['to_string', 'into', 'to_owned', 'clone']);
+    const literalOnly = (block) => {
+        const maskedB = maskRust(block.trim());
+        if (!maskedB.trim())
+            return false;
+        const re = /[A-Za-z_]\w*/g;
+        let m;
+        while ((m = re.exec(maskedB)) !== null) {
+            const id = m[0];
+            if (KEYWORDS.has(id) || /[A-Z]/.test(id[0]) || LITERAL_CHAIN.has(id))
+                continue;
+            return false;
+        }
+        return true;
+    };
+    const usesOnlyVar = (block, name) => {
+        const b = block.trim();
+        if (!b)
+            return false;
+        const maskedB = maskRust(b);
+        const re = new RegExp(String.raw `(?<![\w.])${name}\b`);
+        if (!re.test(maskedB))
+            return false;
+        return !readsOtherValue(b, maskedB, name);
+    };
+    for (const m of masked.matchAll(/\blet\s+(\w+)\s*=\s*if\b/g)) {
+        const bound = m[1];
+        const at = m.index + m[0].length - 2;
+        let depth = 0;
+        let open = -1;
+        for (let i = at + 2; i < masked.length; i++) {
+            const ch = masked[i];
+            if (ch === '(' || ch === '[')
+                depth++;
+            else if (ch === ')' || ch === ']')
+                depth--;
+            else if (ch === '{' && depth === 0) {
+                open = i;
+                break;
+            }
+            else if (ch === ';' || ch === '}')
+                break;
+        }
+        if (open < 0)
+            continue;
+        const cond = code.slice(at + 2, open).trim();
+        const guarded = allowlistVar(cond);
+        if (!guarded)
+            continue;
+        const thenClose = matchBrace(masked, open);
+        if (thenClose < 0)
+            continue;
+        const thenBody = code.slice(open + 1, thenClose);
+        if (!/^\s*else\b/.test(masked.slice(thenClose + 1, thenClose + 10)))
+            continue;
+        const elseOpen = masked.indexOf('{', thenClose + 1);
+        if (elseOpen < 0)
+            continue;
+        const elseClose = matchBrace(masked, elseOpen);
+        if (elseClose < 0)
+            continue;
+        const elseBody = code.slice(elseOpen + 1, elseClose);
+        const inverted = /^\s*!/.test(cond);
+        const ok = inverted
+            ? literalOnly(thenBody) && usesOnlyVar(elseBody, guarded)
+            : usesOnlyVar(thenBody, guarded) && literalOnly(elseBody);
+        if (!ok)
+            continue;
+        const assignLine = masked.slice(0, at).split('\n').length;
+        const mention = new RegExp(String.raw `(?<![\w.])${bound}\b`);
+        for (let l = assignLine; l < origLines.length; l++) {
+            if (!mention.test(maskedLines[l]))
+                continue;
+            out.push({
+                type: 'rust_allowlist_ternary',
+                method: 'guard',
+                line: l + 1,
+                sanitizes: CREDITED_TYPES,
+            });
+        }
+    }
+    return out;
+}
 export function findRustLiteralEqualityGuardSanitizers(code) {
     const masked = maskRust(code);
     const origLines = code.split('\n');
@@ -341,7 +440,7 @@ export function findRustLiteralEqualityGuardSanitizers(code) {
             });
         }
     }
-    return out;
+    return [...out, ...findRustAllowlistTernarySanitizers(code)];
 }
 /**
  * Exact text of the statement that contains `lineStart` (absolute index),