circle-ir 4.16.1 → 4.18.1

package/dist/analysis/constant-propagation/propagator.js

@@ -63,6 +63,11 @@ export class ConstantPropagator {
     taintedArrayElements = new Map();
     // Track current method name for scoping local variables
     currentMethod = null;
+    /** Start lines of nested `{ ... }` blocks — disambiguate same-named locals (#476 Collections10). */
+    blockScopeStack = [];
+    lineBlockScopes = new Map();
+    /** Skip block-scope push on the method/constructor body `{ ... }` (#476). */
+    skipMethodBodyBlockScope = false;
     // Track conditional taints: which variables were tainted under which conditions
     // Maps condition expression string → set of variables tainted under that condition
     conditionalTaints = new Map();
@@ -76,6 +81,8 @@ export class ConstantPropagator {
     inSynchronizedBlock = false;
     // Track iterator sources: iterator variable name → collection name it was created from
     iteratorSources = new Map();
+    /** Vars assigned from `iter.next()` — do not retro-clear on later iterator rebind (#476). */
+    taintedFromIteratorNext = new Set();
     // Track class field names (declared at class level, not local variables)
     classFields = new Set();
     // Track tainted method parameters for inter-procedural analysis
@@ -133,12 +140,16 @@ export class ConstantPropagator {
         this.sanitizedVars.clear();
         this.sanitizedVarUncovered.clear();
         this.currentMethod = null;
+        this.blockScopeStack = [];
+        this.lineBlockScopes.clear();
+        this.skipMethodBodyBlockScope = false;
         this.conditionalTaints.clear();
         this.conditionStack = [];
         this.lineConditions.clear();
         this.synchronizedLines.clear();
         this.inSynchronizedBlock = false;
         this.iteratorSources.clear();
+        this.taintedFromIteratorNext.clear();
         this.classFields.clear();
         this.instanceFieldTaint.clear();
         this.currentClassName = null;
@@ -180,6 +191,9 @@ export class ConstantPropagator {
         // Add unscoped versions of scoped names for backward compatibility
         for (const name of this.tainted) {
             if (name.includes(':')) {
+                if (/^[^:]+:b\d+:/.test(name)) {
+                    continue;
+                }
                 const unscoped = name.substring(name.indexOf(':') + 1);
                 resultTainted.add(unscoped);
             }
@@ -204,6 +218,9 @@ export class ConstantPropagator {
             if (this.goScopedNames.has(name))
                 continue;
             if (name.includes(':')) {
+                if (/^[^:]+:b\d+:/.test(name)) {
+                    continue;
+                }
                 const unscoped = name.substring(name.indexOf(':') + 1);
                 // Only add if not already present (scoped version wins on conflict)
                 if (!resultSymbols.has(unscoped)) {
@@ -214,6 +231,7 @@ export class ConstantPropagator {
         return {
             symbols: resultSymbols,
             tainted: resultTainted,
+            lineBlockScopes: new Map(this.lineBlockScopes),
             unreachableLines: new Set(this.unreachableLines),
             taintedCollections: new Map(this.taintedCollections),
             taintedArrayElements: new Map(this.taintedArrayElements),
@@ -840,6 +858,20 @@ export class ConstantPropagator {
     // ===========================================================================
     // Taint Refinement
     // ===========================================================================
+    /** True when `node` is `iter.next()` (possibly under a cast). */
+    isIteratorNextExpression(node) {
+        const text = getNodeText(node, this.source);
+        if (/\.\s*next\s*\(/.test(text))
+            return true;
+        let current = node;
+        if (current.type === 'cast_expression' || current.type === 'parenthesized_expression') {
+            current = current.childForFieldName('operand') ?? current.childForFieldName('expression');
+        }
+        if (!current || current.type !== 'method_invocation')
+            return false;
+        const nameNode = current.childForFieldName('name');
+        return nameNode ? getNodeText(nameNode, this.source) === 'next' : false;
+    }
     refineTaintFromConstants() {
         let changed = true;
         let iterations = 0;
@@ -849,6 +881,9 @@ export class ConstantPropagator {
             iterations++;
             const toRemove = [];
             for (const varName of this.tainted) {
+                if (this.taintedFromIteratorNext.has(varName)) {
+                    continue;
+                }
                 const symbol = this.symbols.get(varName);
                 if (symbol && symbol.type !== 'unknown') {
                     toRemove.push(varName);
@@ -909,6 +944,9 @@ export class ConstantPropagator {
         if (this.unreachableLines.has(line)) {
             return true; // skip subtree
         }
+        if (this.blockScopeStack.length > 0) {
+            this.lineBlockScopes.set(line, this.blockScopeStack[this.blockScopeStack.length - 1]);
+        }
         // Track which condition this line is under for correlated predicate analysis
         if (this.conditionStack.length > 0 && !this.lineConditions.has(line)) {
             // Use the innermost (most recent) condition
@@ -948,12 +986,24 @@ export class ConstantPropagator {
             case 'assignment_statement':
                 this.handleGoAssignment(node);
                 return false;
+            case 'var_declaration':
+                this.handleGoVarDeclaration(node);
+                return false;
             case 'update_expression':
                 this.handleUpdateExpression(node);
                 return false;
             case 'if_statement':
                 this.handleIfStatement(node);
                 return true;
+            case 'block': {
+                if (this.skipMethodBodyBlockScope) {
+                    this.skipMethodBodyBlockScope = false;
+                }
+                for (const child of node.children) {
+                    this.visit(child);
+                }
+                return true;
+            }
             case 'switch_expression':
             case 'switch_statement':
                 this.handleSwitch(node);
@@ -1046,10 +1096,12 @@ export class ConstantPropagator {
                 }
             }
         }
-        // Visit the method body
+        // Visit the method body (do not treat the outer `{ ... }` as a nested block scope)
         const body = node.childForFieldName('body');
         if (body) {
+            this.skipMethodBodyBlockScope = true;
             this.visit(body);
+            this.skipMethodBodyBlockScope = false;
         }
         // Restore the previous method context
         this.currentMethod = prevMethod;
@@ -1065,11 +1117,36 @@ export class ConstantPropagator {
         if (varName.includes('.') || varName.includes(':')) {
             return varName;
         }
-        // Scope local variables by method name
+        const blockId = this.blockScopeStack.length > 0
+            ? this.blockScopeStack[this.blockScopeStack.length - 1]
+            : undefined;
         if (this.currentMethod) {
-            return `${this.currentMethod}:${varName}`;
+            return blockId !== undefined
+                ? `${this.currentMethod}:b${blockId}:${varName}`
+                : `${this.currentMethod}:${varName}`;
         }
-        return varName;
+        return blockId !== undefined ? `b${blockId}:${varName}` : varName;
+    }
+    /** Innermost block → method → unscoped, for reads that may bind to an outer declaration. */
+    getScopedNameCandidates(varName) {
+        if (varName.includes('.') || varName.includes(':')) {
+            return [varName];
+        }
+        const out = [];
+        for (let i = this.blockScopeStack.length - 1; i >= 0; i--) {
+            const blockId = this.blockScopeStack[i];
+            if (this.currentMethod) {
+                out.push(`${this.currentMethod}:b${blockId}:${varName}`);
+            }
+            else {
+                out.push(`b${blockId}:${varName}`);
+            }
+        }
+        if (this.currentMethod) {
+            out.push(`${this.currentMethod}:${varName}`);
+        }
+        out.push(varName);
+        return out;
     }
     /**
      * Look up a variable value, checking both scoped and unscoped names.
@@ -1077,12 +1154,12 @@ export class ConstantPropagator {
      * either local (scoped) or global (unscoped, like class fields).
      */
     lookupSymbol(varName) {
-        // First try the scoped name (local variable in current method)
-        if (this.currentMethod && !varName.includes('.') && !varName.includes(':')) {
-            const scopedName = `${this.currentMethod}:${varName}`;
-            const scopedValue = this.symbols.get(scopedName);
-            if (scopedValue) {
-                return scopedValue;
+        if (!varName.includes('.') && !varName.includes(':')) {
+            for (const scopedName of this.getScopedNameCandidates(varName)) {
+                const scopedValue = this.symbols.get(scopedName);
+                if (scopedValue) {
+                    return scopedValue;
+                }
             }
         }
         // Fall back to unscoped name (class fields, etc.)
@@ -1152,9 +1229,26 @@ export class ConstantPropagator {
                 this.trackIteratorsInNode(initNode);
             }
         }
-        // Visit all children (condition, body, etc.)
-        for (const child of node.children) {
-            this.visit(child);
+        // #476: shadowing loop locals (`String str` per while) — scope the body block only.
+        if (node.type === 'while_statement' || node.type === 'do_statement') {
+            const body = node.childForFieldName('body');
+            for (const child of node.children) {
+                if (child !== body)
+                    this.visit(child);
+            }
+            if (body?.type === 'block') {
+                this.blockScopeStack.push(getNodeLine(body));
+                this.visit(body);
+                this.blockScopeStack.pop();
+            }
+            else if (body) {
+                this.visit(body);
+            }
+        }
+        else {
+            for (const child of node.children) {
+                this.visit(child);
+            }
         }
         // After visiting children, ensure loop variables stay unknown (they may have been overwritten)
         for (const varName of loopVarNames) {
@@ -1318,6 +1412,10 @@ export class ConstantPropagator {
                             this.sanitizedVars.delete(scopedName); // No longer sanitized if receiving tainted value
                             this.sanitizedVarUncovered.delete(scopedName);
                             this.definitionNodes.set(scopedName, valueNode);
+                            if (this.isIteratorNextExpression(valueNode)) {
+                                this.taintedFromIteratorNext.add(scopedName);
+                                this.taintedFromIteratorNext.add(varName);
+                            }
                             this.symbols.set(scopedName, createUnknown(line));
                         }
                         else {
@@ -1367,6 +1465,71 @@ export class ConstantPropagator {
      * helper that always returns a constant — clears the variable. Anything else stops being tracked here, which is what Go
      * assignments got before this handler existed: the DFG decides.
      */
+    /** `var x = expr` / `var x T = expr` — same clean/taint rules as `:=` (#783). */
+    handleGoVarDeclaration(node) {
+        for (let i = 0; i < node.childCount; i++) {
+            const spec = node.child(i);
+            if (!spec || spec.type !== 'var_spec')
+                continue;
+            const nameNode = spec.childForFieldName('name');
+            let valueNode = spec.childForFieldName('value');
+            if (!nameNode || !valueNode)
+                continue;
+            const names = [];
+            if (nameNode.type === 'identifier') {
+                names.push(getNodeText(nameNode, this.source));
+            }
+            else if (nameNode.type === 'identifier_list') {
+                for (const c of nameNode.children) {
+                    if (c.type === 'identifier')
+                        names.push(getNodeText(c, this.source));
+                }
+            }
+            if (valueNode.type === 'expression_list') {
+                valueNode =
+                    valueNode.children.find((c) => c.type !== ',' && c.type !== 'comment') ?? valueNode;
+            }
+            if (names.length === 0)
+                continue;
+            const line = getNodeLine(node);
+            for (const varName of names) {
+                if (varName === '_')
+                    continue;
+                const scopedName = this.getScopedName(varName);
+                this.goScopedNames.add(scopedName);
+                if (this.isTaintedExpression(valueNode)) {
+                    this.goUnknownVars.add(scopedName);
+                    this.tainted.add(scopedName);
+                    this.sanitizedVars.delete(scopedName);
+                    this.sanitizedVarUncovered.delete(scopedName);
+                    this.definitionNodes.set(scopedName, valueNode);
+                    this.symbols.set(scopedName, createUnknown(line));
+                    continue;
+                }
+                if (!this.isGoKnownCleanRhs(valueNode) || this.goUnknownVars.has(scopedName)) {
+                    this.goUnknownVars.add(scopedName);
+                    this.symbols.delete(scopedName);
+                    this.sanitizedVars.delete(scopedName);
+                    this.sanitizedVarUncovered.delete(scopedName);
+                    if (!this.inConditionalBranch) {
+                        this.tainted.delete(scopedName);
+                        this.definitionNodes.delete(scopedName);
+                    }
+                    continue;
+                }
+                if (this.inConditionalBranch) {
+                    this.goUnknownVars.add(scopedName);
+                    this.symbols.delete(scopedName);
+                    continue;
+                }
+                this.tainted.delete(scopedName);
+                this.definitionNodes.delete(scopedName);
+                this.symbols.set(scopedName, this.evaluateExpression(valueNode));
+                this.sanitizedVars.delete(scopedName);
+                this.sanitizedVarUncovered.delete(scopedName);
+            }
+        }
+    }
     handleGoAssignment(node) {
         const left = node.childForFieldName('left');
         const right = node.childForFieldName('right');
@@ -1477,6 +1640,12 @@ export class ConstantPropagator {
             this.sanitizedVars.delete(scopedName); // No longer sanitized if receiving tainted value
             this.sanitizedVarUncovered.delete(scopedName);
             this.definitionNodes.set(scopedName, right);
+            if (this.isIteratorNextExpression(right)) {
+                this.taintedFromIteratorNext.add(scopedName);
+                if (!varName.includes('.')) {
+                    this.taintedFromIteratorNext.add(varName);
+                }
+            }
             this.symbols.set(scopedName, createUnknown(line));
             // Track constructor field assignments: this.field = taintedParam
             if (this.inConstructor && varName.startsWith('this.')) {
@@ -2319,6 +2488,31 @@ export class ConstantPropagator {
         cache.set(rootId, false);
         return false;
     }
+    /** Is an argument of `call` an inline sanitizer call over tainted input (itself possibly nested)? */
+    argIsSanitizedTaint(call) {
+        const argsNode = call.childForFieldName('arguments');
+        if (!argsNode)
+            return false;
+        for (const arg of argsNode.children) {
+            if (arg.type !== 'method_invocation')
+                continue;
+            const name = arg.childForFieldName('name');
+            if (!name || !SANITIZER_METHODS.has(getNodeText(name, this.source)))
+                continue;
+            const inner = arg.childForFieldName('arguments');
+            if (!inner)
+                continue;
+            for (const a of inner.children) {
+                if (a.type === '(' || a.type === ')' || a.type === ',')
+                    continue;
+                if (this.isTaintedExpression(a))
+                    return true;
+            }
+            if (this.argIsSanitizedTaint(arg))
+                return true;
+        }
+        return false;
+    }
     isTaintedExpressionStep(node) {
         const text = getNodeText(node, this.source);
         if (node.type === 'method_invocation') {
@@ -2326,6 +2520,12 @@ export class ConstantPropagator {
             const objectNode = node.childForFieldName('object');
             if (nameNode) {
                 const methodName = getNodeText(nameNode, this.source);
+                // An anti-sanitizer undoing an inline sanitizer is a round trip
+                // (`Base64.getDecoder().decode(Base64.getEncoder().encode(param.getBytes()))`):
+                // the result carries the sanitizer's tainted input (#976).
+                if (ANTI_SANITIZER_METHODS.has(methodName) && this.argIsSanitizedTaint(node)) {
+                    return true;
+                }
                 if (SANITIZER_METHODS.has(methodName) && !this.localNonSanitizing.has(methodName)) {
                     return false;
                 }
@@ -2620,16 +2820,20 @@ export class ConstantPropagator {
             }
         }
         if (node.type === 'identifier') {
-            // Check both scoped and unscoped taint
-            // Scoped: methodName:varName (for local variables)
-            // Unscoped: varName (for class fields or when not in a method)
-            const scopedName = this.currentMethod ? `${this.currentMethod}:${text}` : text;
-            const isTainted = this.tainted.has(scopedName) || this.tainted.has(text);
-            if (isTainted) {
+            let isTainted = false;
+            let boundName = null;
+            for (const candidate of this.getScopedNameCandidates(text)) {
+                if (this.tainted.has(candidate)) {
+                    isTainted = true;
+                    boundName = candidate;
+                    break;
+                }
+            }
+            if (isTainted && boundName) {
                 // Check if this taint is excluded by correlated predicate analysis
                 // If the variable was tainted under condition C, and we're now under !C,
                 // the taint doesn't apply in this context
-                if (this.isExcludedByCondition(scopedName) || this.isExcludedByCondition(text)) {
+                if (this.isExcludedByCondition(boundName) || this.isExcludedByCondition(text)) {
                     return false;
                 }
             }