circle-ir 4.17.0 → 4.18.1

package/dist/analysis/passes/language-sources-pass.js

@@ -20,6 +20,7 @@ import { javaCallArgument, javaCanonicalBaseLacksSeparator } from '../java-canon
 import { findGoStringsReplacerSanitizers } from '../go-strings-replacer.js';
 import { findRustLiteralEqualityGuardSanitizers } from '../rust-literal-guard.js';
 import { constLookupTables, isConstTableLookup } from '../const-table-lookup.js';
+import { jsReplaceChainVerdict } from '../js-crlf-strip.js';
 // ---------------------------------------------------------------------------
 // Pattern tables (moved from analyzer.ts)
 // ---------------------------------------------------------------------------
@@ -298,6 +299,8 @@ export class LanguageSourcesPass {
             }
             additionalSanitizers.push(...findBashRegexAllowlistSanitizers(code));
             additionalSanitizers.push(...findBashRealpathPrefixGuardSanitizers(code));
+            // #816 CVE-2026-8398: gpg/sha verify-then-install download scripts.
+            additionalSanitizers.push(...findBashVerifiedPackageDownloadSanitizers(code));
             // #213 twelfth slice: printf '%q' + ${var@Q} shell-quote helpers.
             additionalSanitizers.push(...findBashShellQuoteSanitizers(code));
         }
@@ -417,8 +420,14 @@ export class LanguageSourcesPass {
         }
         // -- Rust: safe-handler sanitizer detectors (cognium-dev #115 Sprint 31) --
         if (language === 'rust') {
+            additionalSanitizers.push(...findRustConstSliceMembershipGuardSanitizers(code));
             additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+            // cognium-dev #816 — PAT-INPUT-01 rust safe mirror: parse + range guards
+            // before actix/axum response body (same credit model as JS twin).
+            additionalSanitizers.push(...findRustNumericRangeCheckGuardSanitizers(code));
+            // cognium-dev #816 — PAT-INFO-01: response echoes only query params, no env secrets.
+            additionalSanitizers.push(...findRustPatInfoHttpOnlyResponseSanitizers(code));
             // cognium-dev#293: `if x != "a" && x != "b" { return Err(..) }` literal-equality guard.
             additionalSanitizers.push(...findRustLiteralEqualityGuardSanitizers(code));
             // Sprint 77a (#216 Pattern X): argv-form Command::new(literal).arg(...)
@@ -484,6 +493,9 @@ export class LanguageSourcesPass {
             // #223 REG-144-17/18/19: JS/TS command allowlist guard
             // (Set.has / Array.includes / indexOf) before execFile/spawn.
             additionalSanitizers.push(...findJsCommandAllowlistGuardSanitizers(code));
+            // cognium-dev #816 — PAT-INPUT-01 js safe mirror: Number/parseInt
+            // coercion + finite/range guards before template response.
+            additionalSanitizers.push(...findJsNumericRangeCheckGuardSanitizers(code));
             // Sprint 78 (#190): JS misconfig pattern findings — libxmljs noent:true.
             for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
@@ -517,6 +529,9 @@ export class LanguageSourcesPass {
             for (const finding of findJsLdapInjectionFindings(code, graph.ir.meta.file)) {
                 ctx.addFinding(finding);
             }
+            for (const finding of findJsZipHeaderFailopenFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
             // Sprint 89 (#189): JS insecure_deserialization —
             // JSON.parse(req.body) on raw / text bodies.
             for (const finding of findJsJsonParseBodyFindings(code, graph.ir.meta.file)) {
@@ -576,6 +591,9 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
             // cognium-dev#293: the same strip, but living in a user-defined helper.
             additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, 'java'));
+            // cognium-dev#947: flow-sanitize ssti custom_wrapper — brace-stripping
+            // helper at Velocity.evaluate call site.
+            additionalSanitizers.push(...findJavaTemplateDelimiterWrapperSanitizers(code));
             // Sprint 77a (#216 Pattern X): argv-form exec sanitizer.
             additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
             // Sprint 78 (#190): Java misconfig pattern findings —
@@ -2851,6 +2869,171 @@ function computeDeadPythonBranchLines(lines) {
     }
     return dead;
 }
+/**
+ * Line indices (0-based) in unreachable `if`/`else` arms when the condition is
+ * decidable from tracked integer locals (`int num = 86; if ((7*42)-num > 200) …`).
+ *
+ * Targets OWASP Benchmark shapes where the else arm assigns a parameter but
+ * can never run (cognium-dev#913). Braced bodies defer to constant propagation;
+ * this pass handles the common single-statement `if` / `else` lines.
+ */
+function parseJavaSwitchCaseLabel(label) {
+    const t = label.trim();
+    if (t === 'default')
+        return 'default';
+    const ch = t.match(/^'(\\.|[^'])'\s*$/);
+    if (ch) {
+        const inner = ch[1];
+        if (inner.startsWith('\\')) {
+            if (inner === "\\'")
+                return 39;
+            if (inner === '\\\\')
+                return 92;
+            if (inner === '\\n')
+                return 10;
+            return undefined;
+        }
+        return inner.charCodeAt(0);
+    }
+    const num = t.match(/^(-?\d+)\s*$/);
+    if (num)
+        return Number(num[1]);
+    return undefined;
+}
+function parseJavaSwitchLabelLine(line) {
+    const caseLine = line.match(/^\s*case\s+(.+?)\s*:\s*$/);
+    if (caseLine)
+        return parseJavaSwitchCaseLabel(caseLine[1]);
+    if (/^\s*default\s*:\s*$/.test(line))
+        return 'default';
+    return undefined;
+}
+function markDeadJavaSwitchBodies(lines, switchLineIdx, switchValue, dead) {
+    let depth = 0;
+    let started = false;
+    let groupLabels = [];
+    let bodyStart = -1;
+    let explicitCaseMatched = false;
+    const groupIsTaken = () => {
+        if (groupLabels.length === 0)
+            return false;
+        const explicit = groupLabels.some(v => v !== 'default' && v === switchValue);
+        if (explicit)
+            return true;
+        return groupLabels.includes('default') && !explicitCaseMatched;
+    };
+    const flushGroup = (bodyEnd) => {
+        if (bodyStart < 0 || groupLabels.length === 0)
+            return;
+        const taken = groupIsTaken();
+        if (groupLabels.some(v => v !== 'default' && v === switchValue)) {
+            explicitCaseMatched = true;
+        }
+        if (!taken) {
+            for (let k = bodyStart; k < bodyEnd; k++)
+                dead.add(k);
+        }
+        groupLabels = [];
+        bodyStart = -1;
+    };
+    for (let j = switchLineIdx; j < lines.length; j++) {
+        const line = lines[j];
+        for (const ch of line) {
+            if (ch === '{') {
+                depth++;
+                started = true;
+            }
+            else if (ch === '}')
+                depth--;
+        }
+        if (!started)
+            continue;
+        const label = parseJavaSwitchLabelLine(line);
+        if (label !== undefined) {
+            if (bodyStart >= 0 && j === bodyStart) {
+                groupLabels.push(label);
+                bodyStart = j + 1;
+            }
+            else {
+                flushGroup(j);
+                groupLabels = [label];
+                bodyStart = j + 1;
+            }
+        }
+        if (started && depth === 0) {
+            flushGroup(j);
+            break;
+        }
+    }
+}
+export function computeDeadJavaBranchLines(lines) {
+    const dead = new Set();
+    const consts = new Map();
+    const stringConsts = new Map();
+    const charConsts = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const stringAssign = line.match(/^\s*String\s+([A-Za-z_]\w*)\s*=\s*"([^"]*)"\s*;\s*$/);
+        if (stringAssign) {
+            stringConsts.set(stringAssign[1], stringAssign[2]);
+            continue;
+        }
+        const charAtAssign = line.match(/^\s*char\s+([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*)\.charAt\s*\(\s*(\d+)\s*\)\s*;\s*(?:\/\/.*)?$/);
+        if (charAtAssign) {
+            const str = stringConsts.get(charAtAssign[2]);
+            const idx = Number(charAtAssign[3]);
+            if (str !== undefined && idx >= 0 && idx < str.length) {
+                charConsts.set(charAtAssign[1], str.charCodeAt(idx));
+            }
+            else {
+                charConsts.delete(charAtAssign[1]);
+            }
+            continue;
+        }
+        const intAssign = line.match(/^\s*(?:int|long|short|byte)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/);
+        if (intAssign) {
+            const v = evaluatePythonConstExpression(intAssign[2].trim(), consts);
+            if (typeof v === 'number')
+                consts.set(intAssign[1], v);
+            else
+                consts.delete(intAssign[1]);
+            continue;
+        }
+        const switchMatch = line.match(/^\s*switch\s*\(([^)]+)\)\s*\{?\s*$/);
+        if (switchMatch) {
+            const sel = switchMatch[1].trim();
+            let switchVal = charConsts.get(sel);
+            if (switchVal === undefined) {
+                const n = evaluatePythonConstExpression(sel, consts);
+                if (typeof n === 'number')
+                    switchVal = n;
+            }
+            if (switchVal !== undefined) {
+                markDeadJavaSwitchBodies(lines, i, switchVal, dead);
+            }
+            continue;
+        }
+        const ifMatch = line.match(/^(\s*)if\s*\((.+)\)\s+(.+)$/);
+        if (!ifMatch)
+            continue;
+        const decided = evaluatePythonConstExpression(ifMatch[2].trim(), consts);
+        if (decided !== true && decided !== false)
+            continue;
+        const rest = ifMatch[3].trim();
+        if (/\belse\b/.test(rest))
+            continue;
+        if (i + 1 < lines.length && /^\s*else\b/.test(lines[i + 1])) {
+            if (decided === true)
+                dead.add(i + 1);
+            else
+                dead.add(i);
+        }
+        else if (decided === false) {
+            dead.add(i);
+        }
+    }
+    return dead;
+}
 export function buildPythonTaintedVars(sourceCode) {
     const tainted = new Map();
     const containerTainted = new Map();
@@ -3916,6 +4099,113 @@ export function buildRustTaintedVars(sourceCode, seedVars) {
  * on the way (a lambda, anonymous class, switch expression or block is not a
  * plain wrapped value).
  */
+/** `code(); // note` → `code();` — a `//` inside a string or char literal is kept. */
+function stripJavaTrailingLineComment(line) {
+    let quote = null;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === '\\')
+                i++;
+            else if (c === quote)
+                quote = null;
+        }
+        else if (c === '"' || c === "'") {
+            quote = c;
+        }
+        else if (c === '/' && line[i + 1] === '/') {
+            return line.slice(0, i).trimEnd();
+        }
+    }
+    return line;
+}
+/** Identifiers at code positions in a Java expression (string and char literal bodies dropped). */
+function javaExpressionIdents(expr) {
+    const code = expr.replace(/"(?:[^"\\]|\\.)*"/g, ' ').replace(/'(?:[^'\\]|\\.)'/g, ' ');
+    return code.match(/[\p{L}\p{N}_]+/gu) ?? [];
+}
+/**
+ * `buildJavaTaintedVars` slot tracking (cognium-dev#913/#914/#916/#917). Records
+ * `list.add(x)` / `list.remove(<int>)` / `map.put("<key>", x)` into the slot
+ * tables and returns true for those statements. An `int` constant declaration
+ * is recorded for ternary folding but returns false, so the line is still read
+ * as an assignment.
+ */
+function recordJavaSlotStatement(line, listElems, mapSlots, intConsts) {
+    const t = line.trimEnd().replace(/;\s*\/\/[^"]*$/, ';');
+    const intDecl = /^\s*(?:final\s+)?(?:int|long|short|byte)\s+([A-Za-z_]\w*)\s*=\s*([^;]+);\s*$/.exec(t);
+    if (intDecl) {
+        const v = evaluatePythonConstExpression(intDecl[2].trim(), intConsts);
+        if (typeof v === 'number')
+            intConsts.set(intDecl[1], v);
+        else
+            intConsts.delete(intDecl[1]);
+        return false;
+    }
+    const add = /^\s*([A-Za-z_]\w*)\.add\s*\(\s*([A-Za-z_]\w*|"(?:[^"\\]|\\.)*")\s*\)\s*;\s*$/.exec(t);
+    if (add) {
+        const elems = listElems.get(add[1]) ?? [];
+        elems.push(add[2].startsWith('"') ? null : add[2]);
+        listElems.set(add[1], elems);
+        return true;
+    }
+    const remove = /^\s*([A-Za-z_]\w*)\.remove\s*\(\s*(\d+)\s*\)\s*;\s*$/.exec(t);
+    if (remove && listElems.has(remove[1])) {
+        const elems = listElems.get(remove[1]);
+        const idx = Number(remove[2]);
+        if (idx < elems.length)
+            elems.splice(idx, 1);
+        else
+            listElems.delete(remove[1]); // an index we did not see added: stop trusting the slots
+        return true;
+    }
+    const put = /^\s*([A-Za-z_]\w*)\.put\s*\(\s*"((?:[^"\\]|\\.)*)"\s*,\s*(.+?)\s*\)\s*;\s*$/.exec(t);
+    if (put) {
+        const keys = mapSlots.get(put[1]) ?? new Map();
+        keys.set(put[2], javaExpressionIdents(put[3]));
+        mapSlots.set(put[1], keys);
+        return true;
+    }
+    // Any other use of a tracked collection that is not a plain read (passed to a
+    // call, `addAll`, `set`, `clear`, a non-literal `put`, re-declared …) may change
+    // its contents in a way the tables do not model: stop trusting its slots.
+    for (const table of [listElems, mapSlots]) {
+        for (const name of [...table.keys()]) {
+            const mention = new RegExp(`(?<![\\w.])${name}(?!\\w)`);
+            if (!mention.test(t))
+                continue;
+            const reads = new RegExp(`(?<![\\w.])${name}\\.(?:get|size|isEmpty|contains\\w*)\\s*\\(`, 'g');
+            if (mention.test(t.replace(reads, ' ')))
+                table.delete(name);
+        }
+    }
+    return false;
+}
+/**
+ * The identifiers a `list.get(<int>)` / `map.get("<key>")` read (optionally
+ * cast) can carry, from the slot tables; `undefined` when the RHS is not such a
+ * read or the slots are unknown, so the caller falls back to whole-RHS matching.
+ */
+function javaSlotRead(rhs, listElems, mapSlots) {
+    const m = /^(?:\(\s*[A-Za-z_][\w.<>]*\s*\)\s*)?([A-Za-z_]\w*)\.get\s*\(\s*(\d+|"(?:[^"\\]|\\.)*")\s*\)$/.exec(rhs.trim());
+    if (!m)
+        return undefined;
+    const [, recv, arg] = m;
+    if (arg.startsWith('"')) {
+        const keys = mapSlots.get(recv);
+        if (!keys)
+            return undefined;
+        return keys.get(arg.slice(1, -1)) ?? [];
+    }
+    const elems = listElems.get(recv);
+    if (!elems)
+        return undefined;
+    const idx = Number(arg);
+    if (idx >= elems.length)
+        return undefined;
+    const slot = elems[idx];
+    return slot === null ? [] : [slot];
+}
 function joinWrappedJavaStatement(lines, i) {
     const strip = (l) => l.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)'/g, '""').replace(/\/\/.*$/, '');
     const first = strip(lines[i]);
@@ -3962,10 +4252,30 @@ function joinWrappedJavaStatement(lines, i) {
  * consumed by `detectExpressionScanFlows` in `taint-propagation-pass.ts`
  * to synthesize a virtual source for each derived var.
  */
-export function buildJavaTaintedVars(sourceCode, seedVars) {
+export function buildJavaTaintedVars(sourceCode, seedVars, deadBranchLines, 
+/**
+ * `trackSlots` (cognium-dev#913/#914/#916/#917): follow which element of a list
+ * and which literal key of a map holds taint, and pick the branch of a ternary
+ * whose condition folds to a constant int comparison. Only the helper-return
+ * gate in InterproceduralPass asks for it; every other caller keeps the
+ * whole-collection behaviour.
+ */
+options) {
     const derived = new Map();
     const knownTainted = new Set(seedVars);
-    const lines = sourceCode.split('\n');
+    const trackSlots = options?.trackSlots === true;
+    // Slot mode also reads `x = list.get(0); // note` as the statement it is: the
+    // assignment patterns below are anchored at `;`.
+    const lines = trackSlots
+        ? sourceCode.split('\n').map(stripJavaTrailingLineComment)
+        : sourceCode.split('\n');
+    const dead = deadBranchLines ?? new Set();
+    /** list var → element slots: the added identifier, or `null` for a literal. */
+    const listElems = new Map();
+    /** map var → literal key → the identifiers its stored value mentions. */
+    const mapSlots = new Map();
+    /** int locals with a constant value, for folding a ternary condition. */
+    const intConsts = new Map();
     // Declaration:  [modifiers] Type[<...>] [ ] lhs = rhs;
     // Simple assignment: lhs = rhs;
     // The declaration form is tried first because a Type token in front
@@ -3980,6 +4290,8 @@ export function buildJavaTaintedVars(sourceCode, seedVars) {
     //     original var directly.
     const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
     const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+    const thisFieldAssignRe = /^\s*this\.([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+    const beanSetterCallRe = /\bset([A-Z]\w*)\s*\((.*)\)\s*;?\s*$/;
     const JAVA_KEYWORDS = new Set([
         'if', 'else', 'while', 'for', 'do', 'switch', 'case', 'return',
         'throw', 'try', 'catch', 'finally', 'new', 'this', 'super',
@@ -4003,11 +4315,28 @@ export function buildJavaTaintedVars(sourceCode, seedVars) {
     while (changed && guard < lines.length + 2) {
         changed = false;
         guard++;
+        // Slot state is rebuilt on every pass: it describes the code top to bottom,
+        // while `knownTainted` only grows.
+        listElems.clear();
+        mapSlots.clear();
+        intConsts.clear();
         for (let i = 0; i < lines.length; i++) {
+            if (deadBranchLines !== undefined && dead.has(i))
+                continue;
             const line = lines[i];
             const trimmed = line.trimStart();
             if (trimmed.startsWith('//') || trimmed.startsWith('*'))
                 continue;
+            if (trackSlots && recordJavaSlotStatement(line, listElems, mapSlots, intConsts)) {
+                // `list.add(x)` still taints the list as a whole, as below.
+                const add = /^\s*([A-Za-z_]\w*)\.add\s*\(\s*([A-Za-z_]\w*)\s*\)\s*;/.exec(line);
+                if (add && knownTainted.has(add[2]) && !knownTainted.has(add[1])) {
+                    derived.set(add[1], i + 1);
+                    knownTainted.add(add[1]);
+                    changed = true;
+                }
+                continue;
+            }
             // cognium-dev#476: non-assignment statements (must run before the #753
             // wrap-join early-continue, which would skip them).
             const arrayCopyRe = /\bSystem\.arraycopy\s*\(\s*([A-Za-z_]\w*)\s*,\s*[^,]+\s*,\s*([A-Za-z_]\w*)\s*,/;
@@ -4042,21 +4371,92 @@ export function buildJavaTaintedVars(sourceCode, seedVars) {
                 // statement whose call argument list wraps over several lines reads like
                 // the same statement on one line.
                 const joined = joinWrappedJavaStatement(lines, i);
-                if (joined === null)
-                    continue;
-                statement = joined;
-                declMatch = declRe.exec(statement);
-                assignMatch = !declMatch ? assignRe.exec(statement) : null;
+                if (joined !== null) {
+                    statement = joined;
+                    declMatch = declRe.exec(statement);
+                    assignMatch = !declMatch ? assignRe.exec(statement) : null;
+                }
+            }
+            const thisFieldMatch = thisFieldAssignRe.exec(statement.trim());
+            if (thisFieldMatch) {
+                const fieldName = thisFieldMatch[1];
+                const rhs = thisFieldMatch[2];
+                const rhsCode = rhs
+                    .replace(/\$@?"(?:[^"\\]|\\.)*"/g, lit => ' ' + [...lit.matchAll(/\{([^}]*)\}/g)].map(x => x[1]).join(' ') + ' ')
+                    .replace(/@?"(?:[^"\\]|\\.)*"/g, ' ')
+                    .replace(/'(?:[^'\\]|\\.)'/g, ' ');
+                const rhsIdents = rhsCode.match(/[\p{L}\p{N}_]+/gu);
+                const ref = (rhsIdents !== null && rhsIdents.some(t => knownTainted.has(t))) ||
+                    (complexTaintedRes.length > 0 && complexTaintedRes.some(re => re.test(rhsCode)));
+                if (ref) {
+                    const thisField = `this.${fieldName}`;
+                    if (!knownTainted.has(thisField)) {
+                        derived.set(thisField, i + 1);
+                        knownTainted.add(thisField);
+                        changed = true;
+                    }
+                    if (!knownTainted.has(fieldName)) {
+                        derived.set(fieldName, i + 1);
+                        knownTainted.add(fieldName);
+                        changed = true;
+                    }
+                }
+                continue;
+            }
+            const setterCall = beanSetterCallRe.exec(statement);
+            if (setterCall) {
+                const fieldName = setterCall[1].charAt(0).toLowerCase() + setterCall[1].slice(1);
+                const arg = setterCall[2];
+                const rhsCode = arg
+                    .replace(/\$@?"(?:[^"\\]|\\.)*"/g, lit => ' ' + [...lit.matchAll(/\{([^}]*)\}/g)].map(x => x[1]).join(' ') + ' ')
+                    .replace(/@?"(?:[^"\\]|\\.)*"/g, ' ')
+                    .replace(/'(?:[^'\\]|\\.)'/g, ' ');
+                const rhsIdents = rhsCode.match(/[\p{L}\p{N}_]+/gu);
+                const ref = (rhsIdents !== null && rhsIdents.some(t => knownTainted.has(t))) ||
+                    (complexTaintedRes.length > 0 && complexTaintedRes.some(re => re.test(rhsCode)));
+                if (ref) {
+                    const thisField = `this.${fieldName}`;
+                    if (!knownTainted.has(thisField)) {
+                        derived.set(thisField, i + 1);
+                        knownTainted.add(thisField);
+                        changed = true;
+                    }
+                    if (!knownTainted.has(fieldName)) {
+                        derived.set(fieldName, i + 1);
+                        knownTainted.add(fieldName);
+                        changed = true;
+                    }
+                }
+                continue;
             }
             const m = declMatch ?? assignMatch;
             if (!m)
                 continue;
             const lhs = m[1];
-            const rhs = m[2];
+            let rhs = m[2];
             if (JAVA_KEYWORDS.has(lhs))
                 continue;
             if (knownTainted.has(lhs))
                 continue;
+            if (trackSlots) {
+                const slot = javaSlotRead(rhs, listElems, mapSlots);
+                if (slot !== undefined) {
+                    if (slot.some(t => knownTainted.has(t))) {
+                        derived.set(lhs, i + 1);
+                        knownTainted.add(lhs);
+                        changed = true;
+                    }
+                    continue;
+                }
+                const tern = /^([^?]+?)\s*\?\s*([^:]+?)\s*:\s*(.+)$/.exec(rhs.trim());
+                if (tern) {
+                    const decided = evaluatePythonConstExpression(tern[1].trim().replace(/^\((.*)\)$/, '$1'), intConsts);
+                    if (decided === true)
+                        rhs = tern[2];
+                    else if (decided === false)
+                        rhs = tern[3];
+                }
+            }
             // Reduce the RHS to code positions before matching a tainted var name:
             // keep `$"…{expr}"` interpolation contents, drop plain / verbatim string
             // literal bodies and char literals. Otherwise a tainted var NAME that
@@ -4152,8 +4552,15 @@ function findBashTaintSources(sourceCode, dfg) {
         //    Suppressed inside function bodies (#73 part 1).
         if (!insideFunction) {
             const positionalRe = /\$([1-9@*])|\$\{([1-9@*])\}/g;
+            // A one-line definition `name() { …; }` keeps its body on the header
+            // line: only text before the opening brace is at the top level.
+            const header = /^\s*(?:function\s+)?[A-Za-z_][\w-]*\s*(?:\(\s*\))?\s*\{/.exec(line);
+            const isFnHeader = header !== null && (/\(\s*\)/.test(header[0]) || /^\s*function\s/.test(header[0]));
+            // `$1` inside single quotes is literal text (an awk or sed program), not
+            // a positional parameter.
+            const topLevelText = (isFnHeader ? line.slice(0, header[0].length) : line).replace(/'[^']*'/g, "''");
             let m;
-            while ((m = positionalRe.exec(line)) !== null) {
+            while ((m = positionalRe.exec(topLevelText)) !== null) {
                 const param = m[1] ?? m[2];
                 const alreadyExists = sources.some(s => s.line === lineNumber && s.variable === param);
                 if (!alreadyExists) {
@@ -4893,6 +5300,39 @@ function findBashRealpathPrefixGuardSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * cognium-dev #816 (CVE-2026-8398 `daemon_pkg_install` safe mirror): when a
+ * script downloads a package artifact with curl/wget and later verifies
+ * integrity (gpg/sha) before `dpkg`/`rpm` install, credit the download
+ * step's outbound fetch as gated — same whole-script idiom as
+ * `hasIntegrityVerifierAnywhere` for `unverified-package-install`.
+ */
+function findBashVerifiedPackageDownloadSanitizers(code) {
+    const lines = code.split('\n');
+    if (!hasIntegrityVerifierAnywhere(lines)) {
+        return [];
+    }
+    const hasDownload = lines.some((l) => /\b(curl|wget)\b/.test(l));
+    const hasInstall = lines.some((l) => matchUnverifiedPackageInstall(l.trim()) !== null);
+    if (!hasDownload || !hasInstall) {
+        return [];
+    }
+    const sanitizers = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.trimStart().startsWith('#'))
+            continue;
+        if (!/\b(curl|wget)\b/.test(line))
+            continue;
+        sanitizers.push({
+            type: 'verified_package_download',
+            method: 'curl',
+            line: i + 1,
+            sanitizes: ['ssrf'],
+        });
+    }
+    return sanitizers;
+}
 // ---------------------------------------------------------------------------
 // Go safe-handler sanitizer detectors (cognium-dev #102 Sprint 24)
 // ---------------------------------------------------------------------------
@@ -5194,6 +5634,208 @@ function findPythonNetlocAllowlistGuardSanitizers(code) {
  * or UPPER_SNAKE constants (e.g. MAX_QTY). The guard body must contain
  * a terminator.
  */
+/**
+ * JS/TS numeric range-check guards on Number/parseInt-coerced values
+ * (cognium-dev #816, PAT-INPUT-01 safe mirror; Python twin #114).
+ *
+ *   const qty = parseInt(req.query.qty, 10);
+ *   if (!Number.isFinite(qty) || qty <= 0) return res.status(400).end();
+ *   if (qty > MAX) return res.status(400).end();
+ *   res.end(`xfer ${qty}`);
+ *
+ * Coercion strips xss in DEFAULT_SANITIZERS but template interpolation
+ * re-taints; a proven finite + bounded range guard shows the emitted
+ * scalar cannot carry markup.
+ */
+function findJsNumericRangeCheckGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const coerceDecl = /^\s*(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*(?:Number|parseInt)\s*\(/;
+    const lowerGuard = /\bif\s*\(\s*!(?:Number\.)?isFinite\s*\(\s*([A-Za-z_]\w*)\s*\)|\bif\s*\([^)]*\b([A-Za-z_]\w*)\s*<=\s*0/;
+    const upperGuard = /\bif\s*\(\s*([A-Za-z_]\w*)\s*>\s*(?:\d+|[A-Z][A-Z0-9_]+)\s*\)/;
+    const terminator = /\b(?:return|throw|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json))/;
+    const coerced = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const m = coerceDecl.exec(lines[i]);
+        if (m)
+            coerced.set(m[1], i);
+    }
+    if (coerced.size === 0)
+        return sanitizers;
+    const state = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        let varName = null;
+        let kind = null;
+        const low = lowerGuard.exec(line);
+        if (low) {
+            varName = low[1] ?? low[2];
+            kind = 'lower';
+        }
+        else {
+            const up = upperGuard.exec(line);
+            if (up) {
+                varName = up[1];
+                kind = 'upper';
+            }
+        }
+        if (!varName || !kind || !coerced.has(varName))
+            continue;
+        if (!terminator.test(line)) {
+            let bodyHasTerminator = false;
+            let blockEnd = i;
+            let braceDepth = 0;
+            let started = false;
+            const maxScan = Math.min(lines.length, i + 26);
+            for (let j = i; j < maxScan; j++) {
+                const ln = lines[j];
+                for (const ch of ln) {
+                    if (ch === '{') {
+                        braceDepth++;
+                        started = true;
+                    }
+                    else if (ch === '}') {
+                        braceDepth--;
+                        if (started && braceDepth === 0) {
+                            blockEnd = j;
+                            break;
+                        }
+                    }
+                }
+                if (j > i && terminator.test(ln))
+                    bodyHasTerminator = true;
+                if (started && braceDepth === 0 && blockEnd !== i)
+                    break;
+            }
+            if (!bodyHasTerminator && !started)
+                continue;
+            if (!bodyHasTerminator)
+                continue;
+        }
+        const st = state.get(varName) ?? { lower: false, upper: false, lastGuardEnd: i };
+        if (kind === 'lower')
+            st.lower = true;
+        else
+            st.upper = true;
+        st.lastGuardEnd = i;
+        state.set(varName, st);
+    }
+    for (const [varName, st] of state) {
+        if (!st.lower || !st.upper)
+            continue;
+        const varRefRe = new RegExp(`\\b${varName}\\b`);
+        for (let l = st.lastGuardEnd + 1; l < lines.length; l++) {
+            if (!varRefRe.test(lines[l]))
+                continue;
+            sanitizers.push({
+                type: 'js_numeric_range_check_guard',
+                method: 'if',
+                line: l + 1,
+                sanitizes: ['xss', 'external_taint_escape'],
+            });
+        }
+    }
+    return sanitizers;
+}
+/**
+ * Rust numeric range-check guards on `.parse()`-coerced values
+ * (cognium-dev #816, PAT-INPUT-01 safe mirror).
+ *
+ *   let amount: i32 = amount_str.parse().unwrap_or(0);
+ *   if amount <= 0 { return HttpResponse::BadRequest().finish(); }
+ *   if amount > MAX { return HttpResponse::BadRequest().finish(); }
+ *   HttpResponse::Ok().body(format!("xfer {}", amount))
+ */
+function findRustNumericRangeCheckGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const coerceDecl = /^\s*let\s+([A-Za-z_]\w*)\s*(?::\s*(?:i\d+|u\d+|isize|usize))?\s*=\s*[^;]*\.parse\s*(?:\(\s*\)|::<)/;
+    const lowerGuard = /\bif\s+([A-Za-z_]\w*)\s*<=\s*0\b/;
+    const upperGuard = /\bif\s+([A-Za-z_]\w*)\s*>\s*(?:\d+|[A-Z][A-Z0-9_]+)\b/;
+    const terminator = /\b(?:return\s+HttpResponse::|return\s+StatusCode::|return\s+Err\s*\(|panic!\s*\()/;
+    const coerced = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const m = coerceDecl.exec(lines[i]);
+        if (m)
+            coerced.set(m[1], i);
+    }
+    if (coerced.size === 0)
+        return sanitizers;
+    const state = new Map();
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        let varName = null;
+        let kind = null;
+        const low = lowerGuard.exec(line);
+        if (low) {
+            varName = low[1];
+            kind = 'lower';
+        }
+        else {
+            const up = upperGuard.exec(line);
+            if (up) {
+                varName = up[1];
+                kind = 'upper';
+            }
+        }
+        if (!varName || !kind || !coerced.has(varName))
+            continue;
+        if (!terminator.test(line)) {
+            let bodyHasTerminator = false;
+            let blockEnd = i;
+            let braceDepth = 0;
+            let started = false;
+            const maxScan = Math.min(lines.length, i + 26);
+            for (let j = i; j < maxScan; j++) {
+                const ln = lines[j];
+                for (const ch of ln) {
+                    if (ch === '{') {
+                        braceDepth++;
+                        started = true;
+                    }
+                    else if (ch === '}') {
+                        braceDepth--;
+                        if (started && braceDepth === 0) {
+                            blockEnd = j;
+                            break;
+                        }
+                    }
+                }
+                if (j > i && terminator.test(ln))
+                    bodyHasTerminator = true;
+                if (started && braceDepth === 0 && blockEnd !== i)
+                    break;
+            }
+            if (!bodyHasTerminator && !started)
+                continue;
+            if (!bodyHasTerminator)
+                continue;
+        }
+        const st = state.get(varName) ?? { lower: false, upper: false, lastGuardEnd: i };
+        if (kind === 'lower')
+            st.lower = true;
+        else
+            st.upper = true;
+        st.lastGuardEnd = i;
+        state.set(varName, st);
+    }
+    for (const [varName, st] of state) {
+        if (!st.lower || !st.upper)
+            continue;
+        const varRefRe = new RegExp(`\\b${varName}\\b`);
+        for (let l = st.lastGuardEnd + 1; l < lines.length; l++) {
+            if (!varRefRe.test(lines[l]))
+                continue;
+            sanitizers.push({
+                type: 'rust_numeric_range_check_guard',
+                method: 'if',
+                line: l + 1,
+                sanitizes: ['xss', 'external_taint_escape'],
+            });
+        }
+    }
+    return sanitizers;
+}
 function findPythonRangeCheckGuardSanitizers(code) {
     const sanitizers = [];
     const lines = code.split('\n');
@@ -6062,6 +6704,161 @@ function findPythonDefusedXmlSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * PAT-INFO-01 safe mirror (cognium-dev #816): `HttpResponse` body built with
+ * `format!` interpolates only `web::Query` / `.get(...)` values — no `env::var`.
+ * Credits the sink so CWE-200-style response leaks stay on env-backed TP controls.
+ */
+function findRustPatInfoHttpOnlyResponseSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const bodyFormatRe = /HttpResponse::\w+\(\)\s*\.\s*body\s*\(\s*format!\s*\(/;
+    const envBindRe = /(?:^|[^:])env::var\s*\(|std::env::/;
+    const httpGetRe = /\.get\s*\(\s*"[^"]+"\s*\)/;
+    const letVarRe = (v) => new RegExp(String.raw `^\s*let\s+(?:mut\s+)?${v}\s*=`);
+    for (let i = 0; i < lines.length; i++) {
+        const sinkLine = lines[i];
+        if (!bodyFormatRe.test(sinkLine))
+            continue;
+        if (envBindRe.test(sinkLine))
+            continue;
+        const varRefs = [
+            ...sinkLine.matchAll(/\{([A-Za-z_][A-Za-z0-9_]*)\}/g),
+        ].map((m) => m[1]);
+        if (varRefs.length === 0)
+            continue;
+        let allHttpOnly = true;
+        for (const v of varRefs) {
+            let sawBinding = false;
+            let boundEnv = false;
+            let boundHttp = false;
+            for (let j = i - 1; j >= Math.max(0, i - 24); j--) {
+                const line = lines[j];
+                if (!letVarRe(v).test(line))
+                    continue;
+                sawBinding = true;
+                if (envBindRe.test(line))
+                    boundEnv = true;
+                if (httpGetRe.test(line))
+                    boundHttp = true;
+                break;
+            }
+            if (!sawBinding || boundEnv || !boundHttp) {
+                allHttpOnly = false;
+                break;
+            }
+        }
+        if (!allHttpOnly)
+            continue;
+        sanitizers.push({
+            type: 'rust_pat_info_http_only_body',
+            method: 'format',
+            line: i + 1,
+            sanitizes: [
+                'xss',
+                'external_taint_escape',
+                'open_redirect',
+                'log_injection',
+            ],
+        });
+    }
+    return sanitizers;
+}
+/**
+ * Rust `const SLICE: &[&str] = &["a", "b"]` membership reject guard
+ * (cognium-dev #816 PAT-TRUST-01; Python twin #563).
+ *
+ *   if !THEMES.contains(&theme.as_str()) {
+ *       return HttpResponse::BadRequest().finish();
+ *   }
+ *   session.insert("theme", theme)
+ */
+function collectRustConstStrSliceNames(code) {
+    const names = new Set();
+    const re = /^\s*const\s+([A-Z][A-Z0-9_]*)\s*:\s*&\s*\[\s*&\s*str\s*\]\s*=\s*&\s*\[([^\]]*)\]\s*;/;
+    for (const line of code.split('\n')) {
+        const m = re.exec(line);
+        if (!m)
+            continue;
+        const inner = m[2].trim();
+        if (!inner) {
+            names.add(m[1]);
+            continue;
+        }
+        const elems = inner.split(',').map(s => s.trim()).filter(Boolean);
+        if (elems.every(e => /^"(?:[^"\\]|\\.)*"$/.test(e)))
+            names.add(m[1]);
+    }
+    return names;
+}
+function findRustConstSliceMembershipGuardSanitizers(code) {
+    const sanitizers = [];
+    const slices = collectRustConstStrSliceNames(code);
+    if (slices.size === 0)
+        return sanitizers;
+    const lines = code.split('\n');
+    const guardOpen = /^\s*if\s+!\s*([A-Z][A-Z0-9_]*)\s*\.\s*contains\s*\(\s*&\s*([A-Za-z_]\w*)(?:\s*\.\s*as_str\s*\(\s*\))?\s*\)\s*\{?\s*$/;
+    const terminator = /\b(?:return\s+HttpResponse::|return\s+StatusCode::|return\s+Err\s*\(|panic!\s*\()/;
+    for (let i = 0; i < lines.length; i++) {
+        const m = guardOpen.exec(lines[i]);
+        if (!m)
+            continue;
+        const sliceName = m[1];
+        const guardedVar = m[2];
+        if (!slices.has(sliceName))
+            continue;
+        let depth = 0;
+        for (const ch of lines[i]) {
+            if (ch === '{')
+                depth++;
+            else if (ch === '}')
+                depth--;
+        }
+        let closeLine = i;
+        let bodyHasTerminator = terminator.test(lines[i]);
+        if (depth > 0) {
+            for (let j = i + 1; j < Math.min(lines.length, i + 26); j++) {
+                if (terminator.test(lines[j]))
+                    bodyHasTerminator = true;
+                for (const ch of lines[j]) {
+                    if (ch === '{')
+                        depth++;
+                    else if (ch === '}')
+                        depth--;
+                }
+                if (depth === 0) {
+                    closeLine = j;
+                    break;
+                }
+            }
+        }
+        if (!bodyHasTerminator)
+            continue;
+        const varRe = new RegExp(String.raw `\b${guardedVar}\b`);
+        const reassign = new RegExp(String.raw `^\s*(?:let\s+)?(?:mut\s+)?${guardedVar}\s*=(?!=)`);
+        for (let l = closeLine + 2; l <= lines.length; l++) {
+            const lineText = lines[l - 1];
+            if (!lineText || !varRe.test(lineText))
+                continue;
+            if (reassign.test(lineText))
+                break;
+            sanitizers.push({
+                type: 'rust_const_slice_membership_guard',
+                method: 'if',
+                line: l,
+                sanitizes: [
+                    'trust_boundary',
+                    'external_taint_escape',
+                    'xss',
+                    'open_redirect',
+                    'ssrf',
+                    'command_injection',
+                ],
+            });
+        }
+    }
+    return sanitizers;
+}
 /**
  * Detect Rust HashSet/HashMap host allow-list guards (cognium-dev #115 FP-23).
  *
@@ -6333,6 +7130,16 @@ function findJsCsvFormulaPrefixSanitizers(code) {
  * threat-set. Custom wrappers using different escape strategies (e.g.
  * URL encode) are not yet covered.
  */
+/** Return expression of a small JS wrapper (function or arrow) for #562 chain verdict. */
+function jsWrapperBodyReplaceChainText(body) {
+    const returnM = /\breturn\s+([^;}\n]+)/.exec(body);
+    if (returnM)
+        return returnM[1].trim();
+    const arrowM = /=>\s*([^;}\n]+)/.exec(body);
+    if (arrowM)
+        return arrowM[1].trim();
+    return null;
+}
 function findJsWrapperFunctionSanitizers(code) {
     const sanitizers = [];
     const lines = code.split('\n');
@@ -6355,8 +7162,13 @@ function findJsWrapperFunctionSanitizers(code) {
             kinds.add('external_taint_escape');
         }
         if (crlfCharClass.test(body)) {
-            kinds.add('log_injection');
-            kinds.add('external_taint_escape');
+            const chainText = jsWrapperBodyReplaceChainText(body);
+            const verdict = chainText ? jsReplaceChainVerdict(chainText) : 'undecided';
+            // #562 / #605: LF-only or CRLF-pair-only strips must not credit log_injection.
+            if (verdict !== 'leaves-crlf') {
+                kinds.add('log_injection');
+                kinds.add('external_taint_escape');
+            }
         }
         if (kinds.size > 0)
             wrappers.set(name, kinds);
@@ -7765,6 +8577,87 @@ function javaBodyStripsCrAndLf(body) {
     }
     return cr && lf;
 }
+/** True when the helper removes both `{` and `}` via replace/replaceAll (flow-sanitize ssti). */
+function javaBodyStripsTemplateDelimiters(body) {
+    let open = false;
+    let close = false;
+    for (const m of body.matchAll(/\.\s*(replace|replaceAll)\s*\(\s*(?:"((?:\\.|[^"\\])*)"|'(\\.|[^'\\])')/g)) {
+        const lit = m[2] ?? m[3] ?? '';
+        if (lit === '{')
+            open = true;
+        if (lit === '}')
+            close = true;
+    }
+    return open && close;
+}
+/**
+ * Java user-defined wrapper that strips Velocity/Jinja-style `{` `}` delimiters.
+ * Mirrors flow-sanitize `ssti` / `custom_wrapper` safe mirrors (cognium-dev#947).
+ */
+function findJavaTemplateDelimiterWrapperSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const declRe = /^\s*(?:public|private|protected)?\s*(?:static\s+)?(?:final\s+)?(?:String|CharSequence)\s+([A-Za-z_]\w*)\s*\(/;
+    const bodyWindow = 10;
+    const wrappers = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const m = declRe.exec(lines[i]);
+        if (!m)
+            continue;
+        let end = Math.min(lines.length, i + bodyWindow);
+        for (let j = i + 1; j < end; j++) {
+            if (declRe.test(lines[j])) {
+                end = j;
+                break;
+            }
+        }
+        const body = lines.slice(i, end).join('\n');
+        if (javaBodyStripsTemplateDelimiters(body))
+            wrappers.add(m[1]);
+    }
+    if (wrappers.size === 0)
+        return sanitizers;
+    const kinds = ['code_injection', 'external_taint_escape'];
+    for (const name of wrappers) {
+        const assignedCallRe = new RegExp(`\\b([A-Za-z_][A-Za-z0-9_]*)\\s*=\\s*${name}\\s*\\(`);
+        const bareCallRe = new RegExp(`\\b${name}\\s*\\(`);
+        for (let i = 0; i < lines.length; i++) {
+            if (!bareCallRe.test(lines[i]))
+                continue;
+            if (declRe.test(lines[i]) && bareCallRe.test(lines[i]))
+                continue;
+            sanitizers.push({
+                type: 'java_wrapper_template_delim_strip',
+                method: name,
+                line: i + 1,
+                sanitizes: [...kinds],
+            });
+            const am = assignedCallRe.exec(lines[i]);
+            if (!am)
+                continue;
+            const callIndent = lines[i].length - lines[i].trimStart().length;
+            const validated = am[1];
+            const validatedRe = new RegExp(`\\b${validated}\\b`);
+            for (let j = i + 1; j < lines.length; j++) {
+                const jline = lines[j];
+                if (jline.trim() === '')
+                    continue;
+                const jindent = jline.length - jline.trimStart().length;
+                if (jindent < callIndent)
+                    break;
+                if (validatedRe.test(jline)) {
+                    sanitizers.push({
+                        type: 'java_wrapper_template_delim_strip',
+                        method: name,
+                        line: j + 1,
+                        sanitizes: [...kinds],
+                    });
+                }
+            }
+        }
+    }
+    return sanitizers;
+}
 function findCrlfWrapperFunctionSanitizers(code, language) {
     const sanitizers = [];
     const lines = code.split('\n');
@@ -11196,6 +12089,108 @@ export function findJsLdapInjectionFindings(code, file) {
             snippet: line.trim(),
         });
     }
+    // cognium-dev #899: ldapjs also accepts the filter as the 2nd positional
+    // argument (`client.search(base, '(mail=' + email + ')', cb)`), not only
+    // as `opts.filter`. Flag when that argument is built from tainted data.
+    // Base DN is often comma-separated; only match a quoted first argument.
+    const positionalSearchRe = /\.\s*search\s*\(\s*(?:'[^']*'|"[^"]*")\s*,\s*([^,{]+)/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const pm = line.match(positionalSearchRe);
+        if (!pm)
+            continue;
+        const expr = pm[1].trim();
+        if (expr.startsWith('{'))
+            continue;
+        let tainted = false;
+        for (const v of taintedVars) {
+            if (new RegExp(`\\b${v}\\b`).test(expr)) {
+                tainted = true;
+                break;
+            }
+        }
+        if (!tainted)
+            continue;
+        const lineNo = i + 1;
+        if (seen.has(lineNo))
+            continue;
+        seen.add(lineNo);
+        findings.push({
+            id: `ldap_injection-${file}-${lineNo}-js-ldap-positional-filter`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'ldap_injection',
+            cwe: 'CWE-90',
+            severity: 'critical',
+            level: 'error',
+            message: 'LDAP injection: ldapjs/ldapts `client.search(base, <tainted-filter>, ...)` ' +
+                'lets the attacker break out of the filter expression. Escape user input ' +
+                'or use a structured filter builder.',
+            file,
+            line: lineNo,
+            snippet: line.trim(),
+        });
+    }
+    return findings;
+}
+/**
+ * cognium-dev #897 — ZIP local-file-header validation that fail-opens: after
+ * rejecting an invalid PK\\x03\\x04 signature, returning a slice of the caller
+ * buffer instead of throwing lets untrusted bytes through (CWE-20).
+ */
+export function findJsZipHeaderFailopenFindings(code, file) {
+    const findings = [];
+    if (typeof code !== 'string' || code.length === 0)
+        return findings;
+    const lines = code.split('\n');
+    const hasPkLocalSig = lines.some((l) => {
+        const t = l.trim();
+        if (t.startsWith('//'))
+            return false;
+        return (/0x50/.test(t) &&
+            /0x4[bB]/.test(t) &&
+            /0x03/.test(t) &&
+            /0x04/.test(t));
+    });
+    if (!hasPkLocalSig)
+        return findings;
+    const seen = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (trimmed.startsWith('//'))
+            continue;
+        const failBranch = trimmed.match(/^if\s*\(\s*!(\w+)\s*\)\s*(.+)$/);
+        if (!failBranch)
+            continue;
+        const tail = failBranch[2];
+        if (/\bthrow\b/.test(tail))
+            continue;
+        if (!/\breturn\b/.test(tail))
+            continue;
+        if (!/\.(subarray|slice)\s*\(/.test(tail) &&
+            !/Buffer\.from\s*\(/.test(tail)) {
+            continue;
+        }
+        const lineNo = i + 1;
+        if (seen.has(lineNo))
+            continue;
+        seen.add(lineNo);
+        findings.push({
+            id: `input_validation-${file}-${lineNo}-js-zip-header-failopen`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'input_validation',
+            cwe: 'CWE-20',
+            severity: 'high',
+            level: 'error',
+            message: 'Input validation fail-open: an invalid ZIP local header check still ' +
+                'returns a slice of the caller-controlled buffer. On parse failure, ' +
+                'throw or return empty — do not pass through untrusted bytes.',
+            file,
+            line: lineNo,
+            snippet: trimmed.substring(0, 120),
+        });
+    }
     return findings;
 }
 /**
@@ -11845,6 +12840,53 @@ export function findGoGobDeserializationFindings(code, file) {
     }
     return findings;
 }
+/**
+ * Blank the contents of JS/TS string and template literals and comments,
+ * keeping newlines and every offset, so a line scanner does not match code
+ * that only appears as text (a message describing `JSON.parse(req.body)`).
+ */
+function maskJsLiteralsAndComments(code) {
+    const out = code.split('');
+    let i = 0;
+    const blank = (from, to) => {
+        for (let k = from; k < to; k++)
+            if (out[k] !== '\n')
+                out[k] = ' ';
+    };
+    while (i < code.length) {
+        const c = code[i];
+        const n = code[i + 1];
+        if (c === '/' && n === '/') {
+            let j = i;
+            while (j < code.length && code[j] !== '\n')
+                j++;
+            blank(i, j);
+            i = j;
+        }
+        else if (c === '/' && n === '*') {
+            const end = code.indexOf('*/', i + 2);
+            const j = end < 0 ? code.length : end + 2;
+            blank(i, j);
+            i = j;
+        }
+        else if (c === '"' || c === "'" || c === '`') {
+            let j = i + 1;
+            while (j < code.length && code[j] !== c) {
+                if (code[j] === '\\')
+                    j++;
+                else if (c !== '`' && code[j] === '\n')
+                    break;
+                j++;
+            }
+            blank(i + 1, Math.min(j, code.length));
+            i = j + 1;
+        }
+        else {
+            i++;
+        }
+    }
+    return out.join('');
+}
 /**
  * Sprint 89 detector B (#189) — JS insecure deserialization via
  * `JSON.parse(req.body)`.
@@ -11900,13 +12942,14 @@ export function findJsJsonParseBodyFindings(code, file) {
     }
     const callRe = /\bJSON\s*\.\s*parse\s*\(\s*([^)]+?)\s*\)/g;
     const seen = new Set();
+    // Calls only: `JSON.parse(req.body)` inside a string or comment is text.
+    const codeLines = maskJsLiteralsAndComments(code).split('\n');
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
-        if (line.trim().startsWith('//'))
-            continue;
+        const codeLine = codeLines[i] ?? '';
         callRe.lastIndex = 0;
         let m;
-        while ((m = callRe.exec(line)) !== null) {
+        while ((m = callRe.exec(codeLine)) !== null) {
             const arg = m[1];
             let tainted = reqBodyRe.test(arg);
             if (!tainted) {