circle-ir 4.17.0 → 4.18.1

package/dist/browser/circle-ir.js

@@ -1405,11 +1405,11 @@ var Language = class _Language {
   /**
    * Get the node type id for a node type name.
    */
-  idForNodeType(type, named) {
+  idForNodeType(type, named2) {
     const typeLength = C.lengthBytesUTF8(type);
     const typeAddress = C._malloc(typeLength + 1);
     C.stringToUTF8(type, typeAddress, typeLength + 1);
-    const result = C._ts_language_symbol_for_name(this[0], typeAddress, typeLength, named ? 1 : 0);
+    const result = C._ts_language_symbol_for_name(this[0], typeAddress, typeLength, named2 ? 1 : 0);
     C._free(typeAddress);
     return result || null;
   }
@@ -10410,6 +10410,79 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
       carryBranchDefsOut(popped, scopeStack, alwaysRuns);
       break;
     }
+    case "try_statement":
+    case "try_with_resources_statement": {
+      if (isJavaScript) {
+        const stmtUses = extractUses(stmt, useId, scopeStack, isJavaScript);
+        uses.push(...stmtUses.uses);
+        useId = stmtUses.nextId;
+        break;
+      }
+      scopeStack.push(/* @__PURE__ */ new Map());
+      const resources = stmt.childForFieldName("resources");
+      for (const res of resources?.namedChildren ?? []) {
+        if (!res || res.type !== "resource") continue;
+        const nameNode = res.childForFieldName("name");
+        const value = res.childForFieldName("value");
+        if (value) {
+          const valueUses = extractUses(value, useId, scopeStack, isJavaScript);
+          uses.push(...valueUses.uses);
+          useId = valueUses.nextId;
+        }
+        if (nameNode && nameNode.type === "identifier") {
+          const def = { id: defId++, variable: getNodeText(nameNode), line: nameNode.startPosition.row + 1, column: nameNode.startPosition.column, kind: "local" };
+          defs.push(def);
+          currentScope(scopeStack).set(def.variable, def.id);
+          markDeclared(currentScope(scopeStack), def.variable);
+        } else if (!value) {
+          const resUses = extractUses(res, useId, scopeStack, isJavaScript);
+          uses.push(...resUses.uses);
+          useId = resUses.nextId;
+        }
+      }
+      for (const part of stmt.namedChildren) {
+        if (!part) continue;
+        if (part.type === "block") {
+          const r = processStatement2(part, defId, useId, scopeStack, isJavaScript);
+          defs.push(...r.defs);
+          uses.push(...r.uses);
+          defId = r.nextDefId;
+          useId = r.nextUseId;
+        } else if (part.type === "catch_clause") {
+          scopeStack.push(/* @__PURE__ */ new Map());
+          for (const param of part.namedChildren) {
+            if (!param || param.type !== "catch_formal_parameter") continue;
+            const pname = param.childForFieldName("name");
+            if (pname) {
+              const def = { id: defId++, variable: getNodeText(pname), line: pname.startPosition.row + 1, column: pname.startPosition.column, kind: "local" };
+              defs.push(def);
+              currentScope(scopeStack).set(def.variable, def.id);
+              markDeclared(currentScope(scopeStack), def.variable);
+            }
+          }
+          const body2 = part.childForFieldName("body");
+          if (body2) {
+            const r = processStatement2(body2, defId, useId, scopeStack, isJavaScript);
+            defs.push(...r.defs);
+            uses.push(...r.uses);
+            defId = r.nextDefId;
+            useId = r.nextUseId;
+          }
+          carryBranchDefsOut(scopeStack.pop(), scopeStack, false);
+        } else if (part.type === "finally_clause") {
+          for (const b of part.namedChildren) {
+            if (!b || b.type !== "block") continue;
+            const r = processStatement2(b, defId, useId, scopeStack, isJavaScript);
+            defs.push(...r.defs);
+            uses.push(...r.uses);
+            defId = r.nextDefId;
+            useId = r.nextUseId;
+          }
+        }
+      }
+      carryBranchDefsOut(scopeStack.pop(), scopeStack, false);
+      break;
+    }
     case "else_clause": {
       for (let i2 = 0; i2 < stmt.childCount; i2++) {
         const arm = stmt.child(i2);
@@ -11025,6 +11098,42 @@ function buildBashDFG(tree) {
     defs.push(def);
     currentScope(scopeStack).set(p, def.id);
   }
+  const bashFnDefs = /* @__PURE__ */ new Map();
+  const bashFnByNodeId = /* @__PURE__ */ new Map();
+  for (const fn of findNodes(tree.rootNode, "function_definition")) {
+    const nameNode = fn.childForFieldName("name");
+    if (!nameNode) continue;
+    const fnName = getNodeText(nameNode);
+    if (!fnName || bashFnDefs.has(fnName)) continue;
+    const m = /* @__PURE__ */ new Map();
+    for (const p of positionalParams) {
+      const def = {
+        id: defIdCounter++,
+        variable: p,
+        line: fn.startPosition.row + 1,
+        kind: "param",
+        expression: `bash-fn:${fnName}`
+      };
+      defs.push(def);
+      m.set(p, def.id);
+    }
+    bashFnDefs.set(fnName, m);
+    bashFnByNodeId.set(fn.id, fnName);
+  }
+  const enclosingBashFn = (node) => {
+    let cur = node.parent;
+    while (cur) {
+      if (cur.type === "function_definition") return bashFnByNodeId.get(cur.id) ?? null;
+      cur = cur.parent;
+    }
+    return null;
+  };
+  const positionalDef = (varName, node, fallback) => {
+    if (!positionalParams.includes(varName)) return fallback;
+    const fnName = enclosingBashFn(node);
+    if (!fnName) return fallback;
+    return bashFnDefs.get(fnName)?.get(varName) ?? fallback;
+  };
   walkTree(tree.rootNode, (node) => {
     if (node.type === "variable_assignment") {
       const nameNode = node.childForFieldName("name");
@@ -11077,7 +11186,7 @@ function buildBashDFG(tree) {
       if (varNameNode) {
         const varName = getNodeText(varNameNode);
         if (varName && !varName.startsWith("?") && !varName.startsWith("#")) {
-          let reachingDef = findReachingDef(varName, scopeStack);
+          let reachingDef = positionalDef(varName, node, findReachingDef(varName, scopeStack));
           if (reachingDef === null && !positionalParams.includes(varName)) {
             const def = {
               id: defIdCounter++,
@@ -11101,7 +11210,7 @@ function buildBashDFG(tree) {
       const varNameNode = node.namedChildCount > 0 ? node.namedChild(0) : null;
       if (varNameNode && varNameNode.type === "variable_name") {
         const varName = getNodeText(varNameNode);
-        let reachingDef = findReachingDef(varName, scopeStack);
+        let reachingDef = positionalDef(varName, node, findReachingDef(varName, scopeStack));
         if (reachingDef === null && !positionalParams.includes(varName)) {
           const def = {
             id: defIdCounter++,
@@ -11123,8 +11232,56 @@ function buildBashDFG(tree) {
     }
   });
   const chains = computeChains(defs, uses);
+  chains.push(...bashCallArgChains(tree, bashFnDefs, uses, positionalParams));
   return { defs, uses, chains };
 }
+function bashCallArgChains(tree, bashFnDefs, uses, positionalParams) {
+  const chains = [];
+  if (bashFnDefs.size === 0) return chains;
+  const renumbers = /* @__PURE__ */ new Set();
+  for (const fn of findNodes(tree.rootNode, "function_definition")) {
+    const nameNode = fn.childForFieldName("name");
+    if (!nameNode) continue;
+    if (/\bshift\b|\bset\s+--/.test(getNodeText(fn))) renumbers.add(getNodeText(nameNode));
+  }
+  const usesByLine = /* @__PURE__ */ new Map();
+  for (const u of uses) {
+    const l = usesByLine.get(u.line) ?? [];
+    l.push(u);
+    usesByLine.set(u.line, l);
+  }
+  for (const cmd of findNodes(tree.rootNode, "command")) {
+    const nameNode = cmd.childForFieldName("name");
+    if (!nameNode) continue;
+    const fnDefs = bashFnDefs.get(getNodeText(nameNode));
+    if (!fnDefs) continue;
+    const fnName = getNodeText(nameNode);
+    let position = 0;
+    for (let i2 = 0; i2 < cmd.childCount; i2++) {
+      const arg = cmd.child(i2);
+      if (!arg || arg.id === nameNode.id) continue;
+      if (arg.type.includes("redirect") || arg.type === "heredoc_body" || arg.type === "file_descriptor") continue;
+      const text = getNodeText(arg);
+      if (!text.trim()) continue;
+      position++;
+      const names = /* @__PURE__ */ new Set();
+      const re = /\$\{?([A-Za-z_][A-Za-z0-9_]*|[0-9@*])/g;
+      let m;
+      while ((m = re.exec(text)) !== null) names.add(m[1]);
+      if (names.size === 0) continue;
+      const spreads = /\$\{?[@*]/.test(text);
+      const targets = spreads || renumbers.has(fnName) ? positionalParams.map((p) => fnDefs.get(p)).filter((d) => d !== void 0) : [fnDefs.get(String(position))].filter((d) => d !== void 0);
+      const lineUses = usesByLine.get(arg.startPosition.row + 1) ?? [];
+      for (const name2 of names) {
+        for (const u of lineUses) {
+          if (u.variable !== name2 || u.def_id === null) continue;
+          for (const t of targets) chains.push({ from_def: u.def_id, to_def: t, via: name2 });
+        }
+      }
+    }
+  }
+  return chains;
+}
 function buildRustDFG(tree, cache) {
   const defs = [];
   const uses = [];
@@ -12360,6 +12517,195 @@ function parseDistributedSliceAttribute(attrItem) {
   };
 }
 
+// src/core/extractors/ts-declaration-detail.ts
+function named(node) {
+  const out2 = [];
+  for (let i2 = 0; i2 < node.namedChildCount; i2++) {
+    const c = node.namedChild(i2);
+    if (c && c.type !== "comment") out2.push(c);
+  }
+  return out2;
+}
+function tokens(node) {
+  const out2 = [];
+  for (let i2 = 0; i2 < node.childCount; i2++) {
+    const c = node.child(i2);
+    if (c && !c.isNamed) out2.push(c.text);
+  }
+  return out2;
+}
+function stringLiteral(node) {
+  if (node.type !== "string") return void 0;
+  return named(node).map((c) => c.text).join("");
+}
+function decoratorInfo(node) {
+  const expr = named(node)[0];
+  if (!expr) return null;
+  let callee = expr;
+  let args2 = [];
+  if (expr.type === "call_expression") {
+    callee = expr.childForFieldName("function");
+    const a = expr.childForFieldName("arguments");
+    args2 = a ? named(a) : [];
+  }
+  if (!callee) return null;
+  const name2 = callee.type === "member_expression" ? callee.childForFieldName("property")?.text : callee.text;
+  if (!name2) return null;
+  return {
+    name: name2,
+    arguments: args2.map((a) => {
+      const value = stringLiteral(a);
+      return value === void 0 ? { text: a.text } : { text: a.text, value };
+    })
+  };
+}
+function decoratorsOf(nodes) {
+  return nodes.filter((n) => n.type === "decorator").map(decoratorInfo).filter((d) => d !== null);
+}
+function exportModifiers(holder) {
+  const stmt = holder.parent?.type === "export_statement" ? holder.parent : null;
+  if (!stmt) return [];
+  return tokens(stmt).includes("default") ? ["export", "default"] : ["export"];
+}
+var MEMBER_WORDS = ["readonly", "abstract", "override", "static", "declare"];
+function memberModifiers(member) {
+  const out2 = [];
+  for (let i2 = 0; i2 < member.childCount; i2++) {
+    const c = member.child(i2);
+    if (!c) continue;
+    if (c.type === "accessibility_modifier") out2.push(c.text);
+    else if (c.type === "override_modifier") out2.push("override");
+    else if (!c.isNamed && MEMBER_WORDS.includes(c.text)) out2.push(c.text);
+  }
+  const name2 = member.childForFieldName("name") ?? member.childForFieldName("property");
+  if (name2?.type === "private_property_identifier" && !out2.includes("private")) out2.push("private");
+  return out2;
+}
+function annotationText(node) {
+  return node ? node.text.replace(/^:\s*/, "") : null;
+}
+function addModifiers(target, extra) {
+  for (const m of extra) if (!target.includes(m)) target.push(m);
+}
+function clauseExports(root) {
+  const names = /* @__PURE__ */ new Set();
+  let defaultName = null;
+  for (const stmt of named(root)) {
+    if (stmt.type !== "export_statement" || stmt.childForFieldName("source")) continue;
+    const clause = named(stmt).find((c) => c.type === "export_clause");
+    for (const s of clause ? named(clause) : []) {
+      const name2 = s.childForFieldName("name")?.text;
+      const alias = s.childForFieldName("alias")?.text;
+      if (!name2) continue;
+      if (alias === "default") defaultName = name2;
+      else names.add(name2);
+    }
+    const value = stmt.childForFieldName("value");
+    if (value?.type === "identifier") defaultName = value.text;
+  }
+  return { names, defaultName };
+}
+function enrichMethod(m, fn, decorators, extra) {
+  addModifiers(m.modifiers, extra);
+  const ret = fn.childForFieldName("return_type");
+  if (ret && m.return_type === null) m.return_type = annotationText(ret);
+  const decs = decoratorsOf(decorators);
+  if (decs.length > 0) m.decorators = decs;
+  const params = fn.childForFieldName("parameters");
+  for (const p of params ? named(params) : []) {
+    const pd = decoratorsOf(named(p));
+    if (pd.length === 0) continue;
+    const line = p.startPosition.row + 1;
+    const info2 = m.parameters.find((x) => x.line === line && !x.decorators && p.text.includes(x.name.replace(/^\.\.\./, "")));
+    if (info2) info2.decorators = pd;
+  }
+}
+function enrichClassBody(type, body2) {
+  let pending = [];
+  for (const member of named(body2)) {
+    if (member.type === "decorator") {
+      pending.push(member);
+      continue;
+    }
+    const line = member.startPosition.row + 1;
+    const nameNode = member.childForFieldName("name") ?? member.childForFieldName("property");
+    const name2 = nameNode?.text;
+    if (member.type === "method_definition" && name2) {
+      const m = type.methods.find((x) => x.name === name2 && x.start_line === line);
+      if (m) enrichMethod(m, member, pending, memberModifiers(member));
+    } else if ((member.type === "public_field_definition" || member.type === "field_definition") && name2) {
+      const f = type.fields.find((x) => x.name === name2);
+      if (f) {
+        addModifiers(f.modifiers, memberModifiers(member));
+        if (f.type === null) f.type = annotationText(member.childForFieldName("type"));
+        const decs = decoratorsOf(pending);
+        if (decs.length > 0) f.decorators = decs;
+      }
+    }
+    pending = [];
+  }
+}
+function enrichTsDeclarations(tree, types) {
+  const root = tree.rootNode;
+  const { names, defaultName } = clauseExports(root);
+  const clauseMods = (name2) => name2 === defaultName ? ["export", "default"] : names.has(name2) ? ["export"] : [];
+  const visit = (node) => {
+    const t = node.type;
+    if (t === "class_declaration" || t === "abstract_class_declaration" || t === "interface_declaration") {
+      const line = node.startPosition.row + 1;
+      const name2 = node.childForFieldName("name")?.text;
+      const type = types.find((x) => x.name === name2 && x.start_line === line);
+      if (type && name2) {
+        const mods = [...exportModifiers(node), ...clauseMods(name2)];
+        if (t === "abstract_class_declaration") mods.push("abstract");
+        if (node.parent?.type === "ambient_declaration") mods.push("declare");
+        type.modifiers = [...new Set(mods)];
+        const decs = decoratorsOf([...node.parent?.type === "export_statement" ? named(node.parent) : [], ...named(node)]);
+        if (decs.length > 0) type.decorators = decs;
+        const body2 = node.childForFieldName("body");
+        if (body2 && t !== "interface_declaration") enrichClassBody(type, body2);
+      }
+    } else if (t === "function_declaration" || t === "generator_function_declaration") {
+      const module2 = types.find((x) => x.name === "<module>");
+      const name2 = node.childForFieldName("name")?.text;
+      const m = module2?.methods.find((x) => x.name === name2 && x.start_line === node.startPosition.row + 1);
+      if (m && name2) enrichMethod(m, node, [], [...exportModifiers(node), ...clauseMods(name2)]);
+    } else if (t === "variable_declarator") {
+      const value = node.childForFieldName("value");
+      const name2 = node.childForFieldName("name")?.text;
+      const decl = node.parent;
+      const module2 = types.find((x) => x.name === "<module>");
+      const m = module2?.methods.find((x) => x.name === name2 && x.start_line === node.startPosition.row + 1);
+      if (m && name2 && value?.type === "arrow_function" && decl) enrichMethod(m, value, [], [...exportModifiers(decl), ...clauseMods(name2)]);
+    }
+    for (const c of named(node)) visit(c);
+  };
+  visit(root);
+}
+function extractTsExports(types) {
+  const esm = types.some((t) => t.modifiers?.includes("export") || t.methods.some((m) => m.modifiers.includes("export")));
+  if (!esm) return null;
+  const out2 = [];
+  const visibility = (mods) => mods.includes("private") ? null : mods.includes("protected") ? "protected" : "public";
+  for (const t of types) {
+    if (t.name === "<module>") {
+      for (const m of t.methods) if (m.modifiers.includes("export")) out2.push({ symbol: m.name, kind: "method", visibility: "public" });
+      continue;
+    }
+    if (!t.modifiers?.includes("export")) continue;
+    out2.push({ symbol: t.name, kind: t.kind === "enum" ? "class" : t.kind, visibility: "public" });
+    for (const m of t.methods) {
+      const v = visibility(m.modifiers);
+      if (v) out2.push({ symbol: `${t.name}.${m.name}`, kind: "method", visibility: v });
+    }
+    for (const f of t.fields) {
+      const v = visibility(f.modifiers);
+      if (v) out2.push({ symbol: `${t.name}.${f.name}`, kind: "field", visibility: v });
+    }
+  }
+  return out2;
+}
+
 // src/analysis/config-loader.ts
 var DEFAULT_SOURCES = [
   // HTTP Sources (Servlet API)
@@ -13061,6 +13407,10 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
   { method: "hget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
   { method: "mget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
+  // Node redis clients are often bound to `cache` from `createClient()`; class
+  // `cache` is scoped to JS/TS (Python Django cache above) and Map.get is
+  // filtered in sink-filter-pass (#818 src14).
+  { method: "get", class: "cache", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
@@ -13240,7 +13590,9 @@ var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
   // on arg[1] (the *Cookie) catches struct-literal composite tainting.
   { method: "SetCookie", class: "http", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
   // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
-  { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] }
+  { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
+  // --- Rust: actix-session / tower-sessions write -------------------------
+  { method: "insert", class: "Session", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["rust"] }
 ];
 var DEFAULT_SINKS = [
   // SQL Injection (CWE-89)
@@ -13901,7 +14253,9 @@ var DEFAULT_SINKS = [
   { method: "addParametersToContext", class: "StaticParametersInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "build", class: "HttpParameters", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   // Cron expression parsing (DoS/ReDoS)
-  { method: "parse", class: "CronParser", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0] },
+  // cognium-dev#998 — Java cron-utils `CronParser`; scoped to Java so a JS/TS
+  // `parser.parse(...)` (tree-sitter, a lockfile parser) never matches it by name.
+  { method: "parse", class: "CronParser", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "isValid", class: "CronValidator", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0] },
   // ff4j feature flags
   { method: "check", class: "FF4j", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0] },
@@ -13998,9 +14352,13 @@ var DEFAULT_SINKS = [
   { method: "selectNodes", class: "Node", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0] },
   { method: "selectSingleNode", class: "Node", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0] },
   // XXE - XML External Entity (CWE-611)
-  { method: "parse", class: "DocumentBuilder", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
-  { method: "parse", class: "SAXParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
-  { method: "parse", class: "XMLReader", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
+  // cognium-dev#998 — JAXP parsers are JVM classes. Scoped to Java so the
+  // receiver-name heuristic (`parser` → SAXParser) cannot turn a JS/TS
+  // `parser.parse(text)` into an XXE sink. JS/TS XML parsers (sax, xml2js,
+  // libxmljs, DOMParser) have their own entries.
+  { method: "parse", class: "DocumentBuilder", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "parse", class: "SAXParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "parse", class: "XMLReader", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "unmarshal", class: "Unmarshaller", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
   { method: "newTransformer", class: "TransformerFactory", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
   { method: "transform", class: "Transformer", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
@@ -14255,6 +14613,46 @@ var DEFAULT_SINKS = [
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  // DuckDB from JS/TS: `@duckdb/node-api` (DuckDBConnection), the classic
+  // `duckdb` / `duckdb-async` bindings (Database / Connection) and
+  // `react-native-duckdb` (Database / Transaction). The method names are
+  // generic and the receivers come from factories (`await instance.connect()`,
+  // `open({...})`), so the receiver cannot be typed: the import is the gate
+  // (`requires_import`). Only the SQL text (arg 0) is a sink — values passed
+  // as bound parameters (`run(sql, [v])`, `execute(sql, params)`,
+  // `executeNamed(sql, {k: v})`, `stmt.bind(...)`) are parameterised and do
+  // not reach it.
+  { method: "run", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api", "duckdb", "duckdb-async"] },
+  { method: "prepare", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api", "duckdb", "duckdb-async", "react-native-duckdb"] },
+  { method: "stream", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api", "duckdb", "duckdb-async", "react-native-duckdb"] },
+  { method: "runAndRead", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "runAndReadAll", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "runAndReadUntil", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "streamAndRead", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "streamAndReadAll", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "streamAndReadUntil", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "start", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "startStream", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "extractStatements", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "all", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "each", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "exec", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "arrowIPCAll", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "arrowIPCStream", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "execute", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  { method: "executeSync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  { method: "executeNamed", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  { method: "executeSyncNamed", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  { method: "streamNamed", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  // RxDB (Mango queries, any storage incl. SQLite): a selector or query
+  // object, a field name passed to the query builder, or a `$regex` pattern
+  // under caller control is NoSQL operator injection (CWE-943). Gated on the
+  // `rxdb` import for the same reason as DuckDB above. `find` is already a
+  // classless JS NoSQL sink in the JavaScript plugin.
+  { method: "findOne", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["rxdb"] },
+  { method: "count", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["rxdb"] },
+  { method: "where", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["rxdb"] },
+  { method: "regex", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["rxdb"] },
   // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
   // escape hatch is already covered by the classless `query` sink in the JS
   // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
@@ -14365,6 +14763,8 @@ var DEFAULT_SINKS = [
   { method: "get", class: "http", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "request", class: "https", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "get", class: "https", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // Node.js dns.promises (CWE-918 / NUL-in-name SSRF class — #895)
+  { method: "resolve", class: "dns.promises", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // needle library (used in NodeGoat)
   { method: "get", class: "needle", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "needle", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -14859,7 +15259,7 @@ var DEFAULT_SINKS = [
   // receiver-taint or operator-LHS-taint tracking — the format string is the
   // receiver, not an argument. Deferred to Sprint 6 (#86 follow-up).
   // C-style: printf / fprintf / sprintf / snprintf via ctypes/cffi.
-  { method: "printf", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "printf", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["python", "rust"] },
   { method: "fprintf", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [1], languages: ["python"] },
   // Go: fmt.Sprintf/Printf/Fprintf/Errorf — format string is first/second arg
   { method: "Sprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
@@ -17117,6 +17517,198 @@ function constTableLookupDefIds(defs, code, language) {
   return out2;
 }
 
+// src/analysis/js-crlf-strip.ts
+var MAX_PATTERN_LENGTH = 200;
+var NEUTRAL_AFTER_REPLACE = /* @__PURE__ */ new Set([
+  "replace",
+  "replaceAll",
+  "trim",
+  "trimStart",
+  "trimEnd",
+  "toString",
+  "toLowerCase",
+  "toUpperCase",
+  "slice",
+  "substring"
+]);
+var PROBE = "a\r\rb\n\nc\r\nd\n\re x	";
+function readQuoted(s, i2) {
+  const q = s[i2];
+  if (q !== '"' && q !== "'" && q !== "`") return null;
+  let out2 = "";
+  for (let j = i2 + 1; j < s.length; j++) {
+    const c = s[j];
+    if (c === q) return { value: out2, end: j + 1 };
+    if (q === "`" && c === "$" && s[j + 1] === "{") return null;
+    if (c === "\\") {
+      const n = s[j + 1];
+      if (n === void 0) return null;
+      switch (n) {
+        case "n":
+          out2 += "\n";
+          j++;
+          continue;
+        case "r":
+          out2 += "\r";
+          j++;
+          continue;
+        case "t":
+          out2 += "	";
+          j++;
+          continue;
+        case "0":
+          out2 += "\0";
+          j++;
+          continue;
+        case "x": {
+          const h = /^[0-9a-fA-F]{2}/.exec(s.slice(j + 2, j + 4));
+          if (!h) return null;
+          out2 += String.fromCharCode(parseInt(h[0], 16));
+          j += 3;
+          continue;
+        }
+        case "u": {
+          const h = /^[0-9a-fA-F]{4}/.exec(s.slice(j + 2, j + 6));
+          if (!h) return null;
+          out2 += String.fromCharCode(parseInt(h[0], 16));
+          j += 5;
+          continue;
+        }
+        default:
+          out2 += n;
+          j++;
+          continue;
+      }
+    }
+    if (c === "\n" && q !== "`") return null;
+    out2 += c;
+  }
+  return null;
+}
+function readRegexLiteral(s, i2) {
+  if (s[i2] !== "/") return null;
+  let inClass = false;
+  for (let j = i2 + 1; j < s.length; j++) {
+    const c = s[j];
+    if (c === "\n") return null;
+    if (c === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]") inClass = false;
+      continue;
+    }
+    if (c === "[") {
+      inClass = true;
+      continue;
+    }
+    if (c === "/") {
+      const flags2 = /^[dgimsuvy]*/.exec(s.slice(j + 1))[0];
+      return { source: s.slice(i2 + 1, j), flags: flags2, end: j + 1 + flags2.length };
+    }
+  }
+  return null;
+}
+var skipWs = (s, i2) => {
+  while (i2 < s.length && /\s/.test(s[i2])) i2++;
+  return i2;
+};
+function parseSteps(chainText) {
+  const steps = [];
+  const callRe = /\.\s*(replaceAll|replace)\s*\(/g;
+  let m;
+  while ((m = callRe.exec(chainText)) !== null) {
+    const kind = m[1];
+    let i2 = skipWs(chainText, m.index + m[0].length);
+    let pattern;
+    const rx = readRegexLiteral(chainText, i2);
+    if (rx) {
+      if (rx.source.length > MAX_PATTERN_LENGTH) return null;
+      try {
+        pattern = new RegExp(rx.source, rx.flags);
+      } catch {
+        return null;
+      }
+      i2 = rx.end;
+    } else {
+      const str = readQuoted(chainText, i2);
+      if (!str) return null;
+      pattern = str.value;
+      i2 = str.end;
+    }
+    i2 = skipWs(chainText, i2);
+    if (chainText[i2] !== ",") return null;
+    i2 = skipWs(chainText, i2 + 1);
+    const rep = readQuoted(chainText, i2);
+    if (!rep) return null;
+    i2 = skipWs(chainText, rep.end);
+    if (chainText[i2] !== ")") return null;
+    steps.push({ kind, pattern, replacement: rep.value });
+    callRe.lastIndex = i2 + 1;
+  }
+  return steps;
+}
+function run2(steps, input) {
+  let s = input;
+  try {
+    for (const st of steps) {
+      if (st.kind === "replaceAll" && st.pattern instanceof RegExp && !st.pattern.global) return null;
+      s = st.kind === "replaceAll" ? s.replaceAll(st.pattern, st.replacement) : s.replace(st.pattern, st.replacement);
+    }
+  } catch {
+    return null;
+  }
+  return s;
+}
+function jsReplaceChainVerdict(chainText) {
+  const steps = parseSteps(chainText);
+  if (!steps || steps.length === 0) return "undecided";
+  const first = chainText.search(/\.\s*(?:replaceAll|replace)\s*\(/);
+  for (const seg of chainText.slice(first + 1).matchAll(/\.\s*([A-Za-z_$][\w$]*)\s*\(/g)) {
+    if (!NEUTRAL_AFTER_REPLACE.has(seg[1])) return "undecided";
+  }
+  const out2 = run2(steps, PROBE);
+  if (out2 === null) return "undecided";
+  return out2.includes("\r") || out2.includes("\n") ? "leaves-crlf" : "strips-crlf";
+}
+function jsChainTextAt(sourceLines, line, column) {
+  const text = [(sourceLines[line - 1] ?? "").slice(column), ...sourceLines.slice(line, line + 7)].join("\n");
+  let depth = 0;
+  let prevSig = "";
+  let i2 = 0;
+  for (; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i2++; i2 < text.length && text[i2] !== c; i2++) if (text[i2] === "\\") i2++;
+      prevSig = c;
+      continue;
+    }
+    if (c === "/" && depth > 0 && (prevSig === "(" || prevSig === ",")) {
+      const rx = readRegexLiteral(text, i2);
+      if (rx) {
+        i2 = rx.end - 1;
+        prevSig = "/";
+        continue;
+      }
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      prevSig = c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) break;
+      depth--;
+      prevSig = c;
+      continue;
+    }
+    if (depth === 0 && !/[\w$.\s]/.test(c)) break;
+    if (!/\s/.test(c)) prevSig = c;
+  }
+  return text.slice(0, i2);
+}
+
 // src/analysis/passes/language-sources-pass.ts
 var JS_DOM_XSS_SINKS = [
   { pattern: /\.innerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
@@ -17368,6 +17960,7 @@ var LanguageSourcesPass = class {
       }
       additionalSanitizers.push(...findBashRegexAllowlistSanitizers(code));
       additionalSanitizers.push(...findBashRealpathPrefixGuardSanitizers(code));
+      additionalSanitizers.push(...findBashVerifiedPackageDownloadSanitizers(code));
       additionalSanitizers.push(...findBashShellQuoteSanitizers(code));
     }
     if (language === "go") {
@@ -17483,8 +18076,13 @@ var LanguageSourcesPass = class {
       }
     }
     if (language === "rust") {
+      additionalSanitizers.push(...findRustConstSliceMembershipGuardSanitizers(code));
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+      additionalSanitizers.push(
+        ...findRustNumericRangeCheckGuardSanitizers(code)
+      );
+      additionalSanitizers.push(...findRustPatInfoHttpOnlyResponseSanitizers(code));
       additionalSanitizers.push(...findRustLiteralEqualityGuardSanitizers(code));
       additionalSanitizers.push(...findRustArgvCommandSanitizers(code));
       const rustMisconfigFindings = findRustPatternFindings(code, graph.ir.meta.file);
@@ -17542,6 +18140,9 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(
         ...findJsCommandAllowlistGuardSanitizers(code)
       );
+      additionalSanitizers.push(
+        ...findJsNumericRangeCheckGuardSanitizers(code)
+      );
       for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
       }
@@ -17575,6 +18176,12 @@ var LanguageSourcesPass = class {
       )) {
         ctx.addFinding(finding);
       }
+      for (const finding of findJsZipHeaderFailopenFindings(
+        code,
+        graph.ir.meta.file
+      )) {
+        ctx.addFinding(finding);
+      }
       for (const finding of findJsJsonParseBodyFindings(
         code,
         graph.ir.meta.file
@@ -17624,6 +18231,7 @@ var LanguageSourcesPass = class {
       }
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
       additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, "java"));
+      additionalSanitizers.push(...findJavaTemplateDelimiterWrapperSanitizers(code));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
@@ -18833,9 +19441,9 @@ function findGraphqlResolverArgSources(sourceCode) {
       maps.push(open + inline.index + inline[0].length - 1);
       continue;
     }
-    const named = opts.match(/\bresolvers\s*(?::\s*(\w+))?\s*[,}]/);
-    if (!named) continue;
-    const ident = named[1] ?? "resolvers";
+    const named2 = opts.match(/\bresolvers\s*(?::\s*(\w+))?\s*[,}]/);
+    if (!named2) continue;
+    const ident = named2[1] ?? "resolvers";
     const decl = new RegExp(
       `\\b(?:const|let|var)\\s+${ident}\\s*(?::\\s*[A-Za-z_$][\\w$]*(?:\\s*\\.\\s*[A-Za-z_$][\\w$]*)*(?:\\s*<[^<>=]*(?:<[^<>=]*>[^<>=]*)*>)?\\s*)?=\\s*\\{`
     ).exec(sourceCode);
@@ -18998,15 +19606,15 @@ function evaluatePythonConstExpression(expr, consts) {
   if (parts2.length !== 1) return void 0;
   const matched = expr.match(/\d+|[A-Za-z_][A-Za-z0-9_]*|\/\/|[-+*/%()]|\S/g);
   if (!matched) return void 0;
-  const tokens = matched;
+  const tokens2 = matched;
   let pos = 0;
-  const peek = () => tokens[pos];
+  const peek = () => tokens2[pos];
   const parseFactor = () => {
-    const tok = tokens[pos++];
+    const tok = tokens2[pos++];
     if (tok === void 0) return void 0;
     if (tok === "(") {
       const inner = parseSum();
-      if (tokens[pos++] !== ")") return void 0;
+      if (tokens2[pos++] !== ")") return void 0;
       return inner;
     }
     if (tok === "-") {
@@ -19021,7 +19629,7 @@ function evaluatePythonConstExpression(expr, consts) {
     let value = parseFactor();
     if (value === void 0) return void 0;
     while (peek() === "*" || peek() === "/" || peek() === "//" || peek() === "%") {
-      const op = tokens[pos++];
+      const op = tokens2[pos++];
       const rhs = parseFactor();
       if (rhs === void 0) return void 0;
       if ((op === "/" || op === "//" || op === "%") && rhs === 0) return void 0;
@@ -19036,7 +19644,7 @@ function evaluatePythonConstExpression(expr, consts) {
     let value = parseTerm();
     if (value === void 0) return void 0;
     while (peek() === "+" || peek() === "-") {
-      const op = tokens[pos++];
+      const op = tokens2[pos++];
       const rhs = parseTerm();
       if (rhs === void 0) return void 0;
       value = op === "+" ? value + rhs : value - rhs;
@@ -19044,7 +19652,7 @@ function evaluatePythonConstExpression(expr, consts) {
     return value;
   }
   const result = parseSum();
-  return pos === tokens.length ? result : void 0;
+  return pos === tokens2.length ? result : void 0;
 }
 function normalizeListIndex(index, length) {
   const resolved = index < 0 ? length + index : index;
@@ -19092,6 +19700,140 @@ function computeDeadPythonBranchLines(lines) {
   }
   return dead;
 }
+function parseJavaSwitchCaseLabel(label) {
+  const t = label.trim();
+  if (t === "default") return "default";
+  const ch = t.match(/^'(\\.|[^'])'\s*$/);
+  if (ch) {
+    const inner = ch[1];
+    if (inner.startsWith("\\")) {
+      if (inner === "\\'") return 39;
+      if (inner === "\\\\") return 92;
+      if (inner === "\\n") return 10;
+      return void 0;
+    }
+    return inner.charCodeAt(0);
+  }
+  const num = t.match(/^(-?\d+)\s*$/);
+  if (num) return Number(num[1]);
+  return void 0;
+}
+function parseJavaSwitchLabelLine(line) {
+  const caseLine = line.match(/^\s*case\s+(.+?)\s*:\s*$/);
+  if (caseLine) return parseJavaSwitchCaseLabel(caseLine[1]);
+  if (/^\s*default\s*:\s*$/.test(line)) return "default";
+  return void 0;
+}
+function markDeadJavaSwitchBodies(lines, switchLineIdx, switchValue, dead) {
+  let depth = 0;
+  let started = false;
+  let groupLabels = [];
+  let bodyStart = -1;
+  let explicitCaseMatched = false;
+  const groupIsTaken = () => {
+    if (groupLabels.length === 0) return false;
+    const explicit = groupLabels.some((v) => v !== "default" && v === switchValue);
+    if (explicit) return true;
+    return groupLabels.includes("default") && !explicitCaseMatched;
+  };
+  const flushGroup = (bodyEnd) => {
+    if (bodyStart < 0 || groupLabels.length === 0) return;
+    const taken = groupIsTaken();
+    if (groupLabels.some((v) => v !== "default" && v === switchValue)) {
+      explicitCaseMatched = true;
+    }
+    if (!taken) {
+      for (let k = bodyStart; k < bodyEnd; k++) dead.add(k);
+    }
+    groupLabels = [];
+    bodyStart = -1;
+  };
+  for (let j = switchLineIdx; j < lines.length; j++) {
+    const line = lines[j];
+    for (const ch of line) {
+      if (ch === "{") {
+        depth++;
+        started = true;
+      } else if (ch === "}") depth--;
+    }
+    if (!started) continue;
+    const label = parseJavaSwitchLabelLine(line);
+    if (label !== void 0) {
+      if (bodyStart >= 0 && j === bodyStart) {
+        groupLabels.push(label);
+        bodyStart = j + 1;
+      } else {
+        flushGroup(j);
+        groupLabels = [label];
+        bodyStart = j + 1;
+      }
+    }
+    if (started && depth === 0) {
+      flushGroup(j);
+      break;
+    }
+  }
+}
+function computeDeadJavaBranchLines(lines) {
+  const dead = /* @__PURE__ */ new Set();
+  const consts = /* @__PURE__ */ new Map();
+  const stringConsts = /* @__PURE__ */ new Map();
+  const charConsts = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const stringAssign = line.match(/^\s*String\s+([A-Za-z_]\w*)\s*=\s*"([^"]*)"\s*;\s*$/);
+    if (stringAssign) {
+      stringConsts.set(stringAssign[1], stringAssign[2]);
+      continue;
+    }
+    const charAtAssign = line.match(
+      /^\s*char\s+([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*)\.charAt\s*\(\s*(\d+)\s*\)\s*;\s*(?:\/\/.*)?$/
+    );
+    if (charAtAssign) {
+      const str = stringConsts.get(charAtAssign[2]);
+      const idx = Number(charAtAssign[3]);
+      if (str !== void 0 && idx >= 0 && idx < str.length) {
+        charConsts.set(charAtAssign[1], str.charCodeAt(idx));
+      } else {
+        charConsts.delete(charAtAssign[1]);
+      }
+      continue;
+    }
+    const intAssign = line.match(/^\s*(?:int|long|short|byte)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/);
+    if (intAssign) {
+      const v = evaluatePythonConstExpression(intAssign[2].trim(), consts);
+      if (typeof v === "number") consts.set(intAssign[1], v);
+      else consts.delete(intAssign[1]);
+      continue;
+    }
+    const switchMatch = line.match(/^\s*switch\s*\(([^)]+)\)\s*\{?\s*$/);
+    if (switchMatch) {
+      const sel = switchMatch[1].trim();
+      let switchVal = charConsts.get(sel);
+      if (switchVal === void 0) {
+        const n = evaluatePythonConstExpression(sel, consts);
+        if (typeof n === "number") switchVal = n;
+      }
+      if (switchVal !== void 0) {
+        markDeadJavaSwitchBodies(lines, i2, switchVal, dead);
+      }
+      continue;
+    }
+    const ifMatch = line.match(/^(\s*)if\s*\((.+)\)\s+(.+)$/);
+    if (!ifMatch) continue;
+    const decided = evaluatePythonConstExpression(ifMatch[2].trim(), consts);
+    if (decided !== true && decided !== false) continue;
+    const rest = ifMatch[3].trim();
+    if (/\belse\b/.test(rest)) continue;
+    if (i2 + 1 < lines.length && /^\s*else\b/.test(lines[i2 + 1])) {
+      if (decided === true) dead.add(i2 + 1);
+      else dead.add(i2);
+    } else if (decided === false) {
+      dead.add(i2);
+    }
+  }
+  return dead;
+}
 function buildPythonTaintedVars(sourceCode) {
   const tainted = /* @__PURE__ */ new Map();
   const containerTainted = /* @__PURE__ */ new Map();
@@ -19811,6 +20553,82 @@ function buildRustTaintedVars(sourceCode, seedVars) {
   }
   return derived;
 }
+function stripJavaTrailingLineComment(line) {
+  let quote = null;
+  for (let i2 = 0; i2 < line.length; i2++) {
+    const c = line[i2];
+    if (quote) {
+      if (c === "\\") i2++;
+      else if (c === quote) quote = null;
+    } else if (c === '"' || c === "'") {
+      quote = c;
+    } else if (c === "/" && line[i2 + 1] === "/") {
+      return line.slice(0, i2).trimEnd();
+    }
+  }
+  return line;
+}
+function javaExpressionIdents(expr) {
+  const code = expr.replace(/"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
+  return code.match(/[\p{L}\p{N}_]+/gu) ?? [];
+}
+function recordJavaSlotStatement(line, listElems, mapSlots, intConsts) {
+  const t = line.trimEnd().replace(/;\s*\/\/[^"]*$/, ";");
+  const intDecl = /^\s*(?:final\s+)?(?:int|long|short|byte)\s+([A-Za-z_]\w*)\s*=\s*([^;]+);\s*$/.exec(t);
+  if (intDecl) {
+    const v = evaluatePythonConstExpression(intDecl[2].trim(), intConsts);
+    if (typeof v === "number") intConsts.set(intDecl[1], v);
+    else intConsts.delete(intDecl[1]);
+    return false;
+  }
+  const add = /^\s*([A-Za-z_]\w*)\.add\s*\(\s*([A-Za-z_]\w*|"(?:[^"\\]|\\.)*")\s*\)\s*;\s*$/.exec(t);
+  if (add) {
+    const elems = listElems.get(add[1]) ?? [];
+    elems.push(add[2].startsWith('"') ? null : add[2]);
+    listElems.set(add[1], elems);
+    return true;
+  }
+  const remove = /^\s*([A-Za-z_]\w*)\.remove\s*\(\s*(\d+)\s*\)\s*;\s*$/.exec(t);
+  if (remove && listElems.has(remove[1])) {
+    const elems = listElems.get(remove[1]);
+    const idx = Number(remove[2]);
+    if (idx < elems.length) elems.splice(idx, 1);
+    else listElems.delete(remove[1]);
+    return true;
+  }
+  const put = /^\s*([A-Za-z_]\w*)\.put\s*\(\s*"((?:[^"\\]|\\.)*)"\s*,\s*(.+?)\s*\)\s*;\s*$/.exec(t);
+  if (put) {
+    const keys = mapSlots.get(put[1]) ?? /* @__PURE__ */ new Map();
+    keys.set(put[2], javaExpressionIdents(put[3]));
+    mapSlots.set(put[1], keys);
+    return true;
+  }
+  for (const table of [listElems, mapSlots]) {
+    for (const name2 of [...table.keys()]) {
+      const mention = new RegExp(`(?<![\\w.])${name2}(?!\\w)`);
+      if (!mention.test(t)) continue;
+      const reads = new RegExp(`(?<![\\w.])${name2}\\.(?:get|size|isEmpty|contains\\w*)\\s*\\(`, "g");
+      if (mention.test(t.replace(reads, " "))) table.delete(name2);
+    }
+  }
+  return false;
+}
+function javaSlotRead(rhs, listElems, mapSlots) {
+  const m = /^(?:\(\s*[A-Za-z_][\w.<>]*\s*\)\s*)?([A-Za-z_]\w*)\.get\s*\(\s*(\d+|"(?:[^"\\]|\\.)*")\s*\)$/.exec(rhs.trim());
+  if (!m) return void 0;
+  const [, recv, arg] = m;
+  if (arg.startsWith('"')) {
+    const keys = mapSlots.get(recv);
+    if (!keys) return void 0;
+    return keys.get(arg.slice(1, -1)) ?? [];
+  }
+  const elems = listElems.get(recv);
+  if (!elems) return void 0;
+  const idx = Number(arg);
+  if (idx >= elems.length) return void 0;
+  const slot = elems[idx];
+  return slot === null ? [] : [slot];
+}
 function joinWrappedJavaStatement(lines, i2) {
   const strip = (l) => l.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)'/g, '""').replace(/\/\/.*$/, "");
   const first = strip(lines[i2]);
@@ -19832,12 +20650,19 @@ function joinWrappedJavaStatement(lines, i2) {
   }
   return null;
 }
-function buildJavaTaintedVars(sourceCode, seedVars) {
+function buildJavaTaintedVars(sourceCode, seedVars, deadBranchLines, options) {
   const derived = /* @__PURE__ */ new Map();
   const knownTainted = new Set(seedVars);
-  const lines = sourceCode.split("\n");
+  const trackSlots = options?.trackSlots === true;
+  const lines = trackSlots ? sourceCode.split("\n").map(stripJavaTrailingLineComment) : sourceCode.split("\n");
+  const dead = deadBranchLines ?? /* @__PURE__ */ new Set();
+  const listElems = /* @__PURE__ */ new Map();
+  const mapSlots = /* @__PURE__ */ new Map();
+  const intConsts = /* @__PURE__ */ new Map();
   const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
   const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const thisFieldAssignRe = /^\s*this\.([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const beanSetterCallRe = /\bset([A-Z]\w*)\s*\((.*)\)\s*;?\s*$/;
   const JAVA_KEYWORDS = /* @__PURE__ */ new Set([
     "if",
     "else",
@@ -19873,10 +20698,23 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
   while (changed && guard < lines.length + 2) {
     changed = false;
     guard++;
+    listElems.clear();
+    mapSlots.clear();
+    intConsts.clear();
     for (let i2 = 0; i2 < lines.length; i2++) {
+      if (deadBranchLines !== void 0 && dead.has(i2)) continue;
       const line = lines[i2];
       const trimmed = line.trimStart();
       if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+      if (trackSlots && recordJavaSlotStatement(line, listElems, mapSlots, intConsts)) {
+        const add = /^\s*([A-Za-z_]\w*)\.add\s*\(\s*([A-Za-z_]\w*)\s*\)\s*;/.exec(line);
+        if (add && knownTainted.has(add[2]) && !knownTainted.has(add[1])) {
+          derived.set(add[1], i2 + 1);
+          knownTainted.add(add[1]);
+          changed = true;
+        }
+        continue;
+      }
       const arrayCopyRe = /\bSystem\.arraycopy\s*\(\s*([A-Za-z_]\w*)\s*,\s*[^,]+\s*,\s*([A-Za-z_]\w*)\s*,/;
       const acMatch = arrayCopyRe.exec(line);
       if (acMatch) {
@@ -19906,17 +20744,79 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
       let assignMatch = !declMatch ? assignRe.exec(statement) : null;
       if (!declMatch && !assignMatch) {
         const joined = joinWrappedJavaStatement(lines, i2);
-        if (joined === null) continue;
-        statement = joined;
-        declMatch = declRe.exec(statement);
-        assignMatch = !declMatch ? assignRe.exec(statement) : null;
+        if (joined !== null) {
+          statement = joined;
+          declMatch = declRe.exec(statement);
+          assignMatch = !declMatch ? assignRe.exec(statement) : null;
+        }
+      }
+      const thisFieldMatch = thisFieldAssignRe.exec(statement.trim());
+      if (thisFieldMatch) {
+        const fieldName = thisFieldMatch[1];
+        const rhs2 = thisFieldMatch[2];
+        const rhsCode2 = rhs2.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
+        const rhsIdents2 = rhsCode2.match(/[\p{L}\p{N}_]+/gu);
+        const ref2 = rhsIdents2 !== null && rhsIdents2.some((t) => knownTainted.has(t)) || complexTaintedRes.length > 0 && complexTaintedRes.some((re) => re.test(rhsCode2));
+        if (ref2) {
+          const thisField = `this.${fieldName}`;
+          if (!knownTainted.has(thisField)) {
+            derived.set(thisField, i2 + 1);
+            knownTainted.add(thisField);
+            changed = true;
+          }
+          if (!knownTainted.has(fieldName)) {
+            derived.set(fieldName, i2 + 1);
+            knownTainted.add(fieldName);
+            changed = true;
+          }
+        }
+        continue;
+      }
+      const setterCall = beanSetterCallRe.exec(statement);
+      if (setterCall) {
+        const fieldName = setterCall[1].charAt(0).toLowerCase() + setterCall[1].slice(1);
+        const arg = setterCall[2];
+        const rhsCode2 = arg.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
+        const rhsIdents2 = rhsCode2.match(/[\p{L}\p{N}_]+/gu);
+        const ref2 = rhsIdents2 !== null && rhsIdents2.some((t) => knownTainted.has(t)) || complexTaintedRes.length > 0 && complexTaintedRes.some((re) => re.test(rhsCode2));
+        if (ref2) {
+          const thisField = `this.${fieldName}`;
+          if (!knownTainted.has(thisField)) {
+            derived.set(thisField, i2 + 1);
+            knownTainted.add(thisField);
+            changed = true;
+          }
+          if (!knownTainted.has(fieldName)) {
+            derived.set(fieldName, i2 + 1);
+            knownTainted.add(fieldName);
+            changed = true;
+          }
+        }
+        continue;
       }
       const m = declMatch ?? assignMatch;
       if (!m) continue;
       const lhs = m[1];
-      const rhs = m[2];
+      let rhs = m[2];
       if (JAVA_KEYWORDS.has(lhs)) continue;
       if (knownTainted.has(lhs)) continue;
+      if (trackSlots) {
+        const slot = javaSlotRead(rhs, listElems, mapSlots);
+        if (slot !== void 0) {
+          if (slot.some((t) => knownTainted.has(t))) {
+            derived.set(lhs, i2 + 1);
+            knownTainted.add(lhs);
+            changed = true;
+          }
+          continue;
+        }
+        const tern = /^([^?]+?)\s*\?\s*([^:]+?)\s*:\s*(.+)$/.exec(rhs.trim());
+        if (tern) {
+          const decided = evaluatePythonConstExpression(tern[1].trim().replace(/^\((.*)\)$/, "$1"), intConsts);
+          if (decided === true) rhs = tern[2];
+          else if (decided === false) rhs = tern[3];
+        }
+      }
       const rhsCode = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
       const rhsIdents = rhsCode.match(/[\p{L}\p{N}_]+/gu);
       const ref = rhsIdents !== null && rhsIdents.some((t) => knownTainted.has(t)) || complexTaintedRes.length > 0 && complexTaintedRes.some((re) => re.test(rhsCode));
@@ -19968,8 +20868,11 @@ function findBashTaintSources(sourceCode, dfg) {
     const insideFunction = braceDepth > 0;
     if (!insideFunction) {
       const positionalRe = /\$([1-9@*])|\$\{([1-9@*])\}/g;
+      const header = /^\s*(?:function\s+)?[A-Za-z_][\w-]*\s*(?:\(\s*\))?\s*\{/.exec(line);
+      const isFnHeader = header !== null && (/\(\s*\)/.test(header[0]) || /^\s*function\s/.test(header[0]));
+      const topLevelText = (isFnHeader ? line.slice(0, header[0].length) : line).replace(/'[^']*'/g, "''");
       let m;
-      while ((m = positionalRe.exec(line)) !== null) {
+      while ((m = positionalRe.exec(topLevelText)) !== null) {
         const param = m[1] ?? m[2];
         const alreadyExists = sources.some((s) => s.line === lineNumber && s.variable === param);
         if (!alreadyExists) {
@@ -20025,10 +20928,10 @@ function findBashTaintSources(sourceCode, dfg) {
     if (readMatch) {
       const argStr = readMatch[1].trim();
       const noRedirect = argStr.replace(/\s*<[^<].*$/, "").trim();
-      const tokens = noRedirect.split(/\s+/);
+      const tokens2 = noRedirect.split(/\s+/);
       const varNames = [];
-      for (let ti = 0; ti < tokens.length; ti++) {
-        const tok = tokens[ti];
+      for (let ti = 0; ti < tokens2.length; ti++) {
+        const tok = tokens2[ti];
         if (!tok) continue;
         if (tok.startsWith("-")) {
           if (/^-[antpidu]$|^-N$/.test(tok)) ti++;
@@ -20053,10 +20956,10 @@ function findBashTaintSources(sourceCode, dfg) {
     const mapfileMatch = /^(?:mapfile|readarray)\s*\(/.test(trimmed) ? null : trimmed.match(/^(?:mapfile|readarray)\b([^#(]*)$/);
     if (mapfileMatch) {
       const argStr = mapfileMatch[1].trim();
-      const tokens = argStr.split(/\s+/);
+      const tokens2 = argStr.split(/\s+/);
       const varNames = [];
-      for (let ti = 0; ti < tokens.length; ti++) {
-        const tok = tokens[ti];
+      for (let ti = 0; ti < tokens2.length; ti++) {
+        const tok = tokens2[ti];
         if (!tok) continue;
         if (tok.startsWith("-")) {
           if (/^-[cCnOsud]$/.test(tok)) ti++;
@@ -20441,6 +21344,30 @@ function findBashRealpathPrefixGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findBashVerifiedPackageDownloadSanitizers(code) {
+  const lines = code.split("\n");
+  if (!hasIntegrityVerifierAnywhere(lines)) {
+    return [];
+  }
+  const hasDownload = lines.some((l) => /\b(curl|wget)\b/.test(l));
+  const hasInstall = lines.some((l) => matchUnverifiedPackageInstall(l.trim()) !== null);
+  if (!hasDownload || !hasInstall) {
+    return [];
+  }
+  const sanitizers = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trimStart().startsWith("#")) continue;
+    if (!/\b(curl|wget)\b/.test(line)) continue;
+    sanitizers.push({
+      type: "verified_package_download",
+      method: "curl",
+      line: i2 + 1,
+      sanitizes: ["ssrf"]
+    });
+  }
+  return sanitizers;
+}
 function findGoMapAllowlistGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -20596,6 +21523,160 @@ function findPythonNetlocAllowlistGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJsNumericRangeCheckGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const coerceDecl = /^\s*(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*(?:Number|parseInt)\s*\(/;
+  const lowerGuard = /\bif\s*\(\s*!(?:Number\.)?isFinite\s*\(\s*([A-Za-z_]\w*)\s*\)|\bif\s*\([^)]*\b([A-Za-z_]\w*)\s*<=\s*0/;
+  const upperGuard = /\bif\s*\(\s*([A-Za-z_]\w*)\s*>\s*(?:\d+|[A-Z][A-Z0-9_]+)\s*\)/;
+  const terminator = /\b(?:return|throw|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json))/;
+  const coerced = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = coerceDecl.exec(lines[i2]);
+    if (m) coerced.set(m[1], i2);
+  }
+  if (coerced.size === 0) return sanitizers;
+  const state = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    let varName = null;
+    let kind = null;
+    const low = lowerGuard.exec(line);
+    if (low) {
+      varName = low[1] ?? low[2];
+      kind = "lower";
+    } else {
+      const up = upperGuard.exec(line);
+      if (up) {
+        varName = up[1];
+        kind = "upper";
+      }
+    }
+    if (!varName || !kind || !coerced.has(varName)) continue;
+    if (!terminator.test(line)) {
+      let bodyHasTerminator = false;
+      let blockEnd = i2;
+      let braceDepth = 0;
+      let started = false;
+      const maxScan = Math.min(lines.length, i2 + 26);
+      for (let j = i2; j < maxScan; j++) {
+        const ln = lines[j];
+        for (const ch of ln) {
+          if (ch === "{") {
+            braceDepth++;
+            started = true;
+          } else if (ch === "}") {
+            braceDepth--;
+            if (started && braceDepth === 0) {
+              blockEnd = j;
+              break;
+            }
+          }
+        }
+        if (j > i2 && terminator.test(ln)) bodyHasTerminator = true;
+        if (started && braceDepth === 0 && blockEnd !== i2) break;
+      }
+      if (!bodyHasTerminator && !started) continue;
+      if (!bodyHasTerminator) continue;
+    }
+    const st = state.get(varName) ?? { lower: false, upper: false, lastGuardEnd: i2 };
+    if (kind === "lower") st.lower = true;
+    else st.upper = true;
+    st.lastGuardEnd = i2;
+    state.set(varName, st);
+  }
+  for (const [varName, st] of state) {
+    if (!st.lower || !st.upper) continue;
+    const varRefRe = new RegExp(`\\b${varName}\\b`);
+    for (let l = st.lastGuardEnd + 1; l < lines.length; l++) {
+      if (!varRefRe.test(lines[l])) continue;
+      sanitizers.push({
+        type: "js_numeric_range_check_guard",
+        method: "if",
+        line: l + 1,
+        sanitizes: ["xss", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findRustNumericRangeCheckGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const coerceDecl = /^\s*let\s+([A-Za-z_]\w*)\s*(?::\s*(?:i\d+|u\d+|isize|usize))?\s*=\s*[^;]*\.parse\s*(?:\(\s*\)|::<)/;
+  const lowerGuard = /\bif\s+([A-Za-z_]\w*)\s*<=\s*0\b/;
+  const upperGuard = /\bif\s+([A-Za-z_]\w*)\s*>\s*(?:\d+|[A-Z][A-Z0-9_]+)\b/;
+  const terminator = /\b(?:return\s+HttpResponse::|return\s+StatusCode::|return\s+Err\s*\(|panic!\s*\()/;
+  const coerced = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = coerceDecl.exec(lines[i2]);
+    if (m) coerced.set(m[1], i2);
+  }
+  if (coerced.size === 0) return sanitizers;
+  const state = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    let varName = null;
+    let kind = null;
+    const low = lowerGuard.exec(line);
+    if (low) {
+      varName = low[1];
+      kind = "lower";
+    } else {
+      const up = upperGuard.exec(line);
+      if (up) {
+        varName = up[1];
+        kind = "upper";
+      }
+    }
+    if (!varName || !kind || !coerced.has(varName)) continue;
+    if (!terminator.test(line)) {
+      let bodyHasTerminator = false;
+      let blockEnd = i2;
+      let braceDepth = 0;
+      let started = false;
+      const maxScan = Math.min(lines.length, i2 + 26);
+      for (let j = i2; j < maxScan; j++) {
+        const ln = lines[j];
+        for (const ch of ln) {
+          if (ch === "{") {
+            braceDepth++;
+            started = true;
+          } else if (ch === "}") {
+            braceDepth--;
+            if (started && braceDepth === 0) {
+              blockEnd = j;
+              break;
+            }
+          }
+        }
+        if (j > i2 && terminator.test(ln)) bodyHasTerminator = true;
+        if (started && braceDepth === 0 && blockEnd !== i2) break;
+      }
+      if (!bodyHasTerminator && !started) continue;
+      if (!bodyHasTerminator) continue;
+    }
+    const st = state.get(varName) ?? { lower: false, upper: false, lastGuardEnd: i2 };
+    if (kind === "lower") st.lower = true;
+    else st.upper = true;
+    st.lastGuardEnd = i2;
+    state.set(varName, st);
+  }
+  for (const [varName, st] of state) {
+    if (!st.lower || !st.upper) continue;
+    const varRefRe = new RegExp(`\\b${varName}\\b`);
+    for (let l = st.lastGuardEnd + 1; l < lines.length; l++) {
+      if (!varRefRe.test(lines[l])) continue;
+      sanitizers.push({
+        type: "rust_numeric_range_check_guard",
+        method: "if",
+        line: l + 1,
+        sanitizes: ["xss", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findPythonRangeCheckGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -21182,6 +22263,127 @@ function findPythonDefusedXmlSanitizers(code) {
   }
   return sanitizers;
 }
+function findRustPatInfoHttpOnlyResponseSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const bodyFormatRe = /HttpResponse::\w+\(\)\s*\.\s*body\s*\(\s*format!\s*\(/;
+  const envBindRe = /(?:^|[^:])env::var\s*\(|std::env::/;
+  const httpGetRe = /\.get\s*\(\s*"[^"]+"\s*\)/;
+  const letVarRe = (v) => new RegExp(String.raw`^\s*let\s+(?:mut\s+)?${v}\s*=`);
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const sinkLine = lines[i2];
+    if (!bodyFormatRe.test(sinkLine)) continue;
+    if (envBindRe.test(sinkLine)) continue;
+    const varRefs = [
+      ...sinkLine.matchAll(/\{([A-Za-z_][A-Za-z0-9_]*)\}/g)
+    ].map((m) => m[1]);
+    if (varRefs.length === 0) continue;
+    let allHttpOnly = true;
+    for (const v of varRefs) {
+      let sawBinding = false;
+      let boundEnv = false;
+      let boundHttp = false;
+      for (let j = i2 - 1; j >= Math.max(0, i2 - 24); j--) {
+        const line = lines[j];
+        if (!letVarRe(v).test(line)) continue;
+        sawBinding = true;
+        if (envBindRe.test(line)) boundEnv = true;
+        if (httpGetRe.test(line)) boundHttp = true;
+        break;
+      }
+      if (!sawBinding || boundEnv || !boundHttp) {
+        allHttpOnly = false;
+        break;
+      }
+    }
+    if (!allHttpOnly) continue;
+    sanitizers.push({
+      type: "rust_pat_info_http_only_body",
+      method: "format",
+      line: i2 + 1,
+      sanitizes: [
+        "xss",
+        "external_taint_escape",
+        "open_redirect",
+        "log_injection"
+      ]
+    });
+  }
+  return sanitizers;
+}
+function collectRustConstStrSliceNames(code) {
+  const names = /* @__PURE__ */ new Set();
+  const re = /^\s*const\s+([A-Z][A-Z0-9_]*)\s*:\s*&\s*\[\s*&\s*str\s*\]\s*=\s*&\s*\[([^\]]*)\]\s*;/;
+  for (const line of code.split("\n")) {
+    const m = re.exec(line);
+    if (!m) continue;
+    const inner = m[2].trim();
+    if (!inner) {
+      names.add(m[1]);
+      continue;
+    }
+    const elems = inner.split(",").map((s) => s.trim()).filter(Boolean);
+    if (elems.every((e) => /^"(?:[^"\\]|\\.)*"$/.test(e))) names.add(m[1]);
+  }
+  return names;
+}
+function findRustConstSliceMembershipGuardSanitizers(code) {
+  const sanitizers = [];
+  const slices = collectRustConstStrSliceNames(code);
+  if (slices.size === 0) return sanitizers;
+  const lines = code.split("\n");
+  const guardOpen = /^\s*if\s+!\s*([A-Z][A-Z0-9_]*)\s*\.\s*contains\s*\(\s*&\s*([A-Za-z_]\w*)(?:\s*\.\s*as_str\s*\(\s*\))?\s*\)\s*\{?\s*$/;
+  const terminator = /\b(?:return\s+HttpResponse::|return\s+StatusCode::|return\s+Err\s*\(|panic!\s*\()/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = guardOpen.exec(lines[i2]);
+    if (!m) continue;
+    const sliceName = m[1];
+    const guardedVar = m[2];
+    if (!slices.has(sliceName)) continue;
+    let depth = 0;
+    for (const ch of lines[i2]) {
+      if (ch === "{") depth++;
+      else if (ch === "}") depth--;
+    }
+    let closeLine = i2;
+    let bodyHasTerminator = terminator.test(lines[i2]);
+    if (depth > 0) {
+      for (let j = i2 + 1; j < Math.min(lines.length, i2 + 26); j++) {
+        if (terminator.test(lines[j])) bodyHasTerminator = true;
+        for (const ch of lines[j]) {
+          if (ch === "{") depth++;
+          else if (ch === "}") depth--;
+        }
+        if (depth === 0) {
+          closeLine = j;
+          break;
+        }
+      }
+    }
+    if (!bodyHasTerminator) continue;
+    const varRe = new RegExp(String.raw`\b${guardedVar}\b`);
+    const reassign = new RegExp(String.raw`^\s*(?:let\s+)?(?:mut\s+)?${guardedVar}\s*=(?!=)`);
+    for (let l = closeLine + 2; l <= lines.length; l++) {
+      const lineText = lines[l - 1];
+      if (!lineText || !varRe.test(lineText)) continue;
+      if (reassign.test(lineText)) break;
+      sanitizers.push({
+        type: "rust_const_slice_membership_guard",
+        method: "if",
+        line: l,
+        sanitizes: [
+          "trust_boundary",
+          "external_taint_escape",
+          "xss",
+          "open_redirect",
+          "ssrf",
+          "command_injection"
+        ]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findRustSetAllowlistGuardSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -21338,6 +22540,13 @@ function findJsCsvFormulaPrefixSanitizers(code) {
   }
   return sanitizers;
 }
+function jsWrapperBodyReplaceChainText(body2) {
+  const returnM = /\breturn\s+([^;}\n]+)/.exec(body2);
+  if (returnM) return returnM[1].trim();
+  const arrowM = /=>\s*([^;}\n]+)/.exec(body2);
+  if (arrowM) return arrowM[1].trim();
+  return null;
+}
 function findJsWrapperFunctionSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -21357,8 +22566,12 @@ function findJsWrapperFunctionSanitizers(code) {
       kinds.add("external_taint_escape");
     }
     if (crlfCharClass.test(body2)) {
-      kinds.add("log_injection");
-      kinds.add("external_taint_escape");
+      const chainText = jsWrapperBodyReplaceChainText(body2);
+      const verdict = chainText ? jsReplaceChainVerdict(chainText) : "undecided";
+      if (verdict !== "leaves-crlf") {
+        kinds.add("log_injection");
+        kinds.add("external_taint_escape");
+      }
     }
     if (kinds.size > 0) wrappers.set(name2, kinds);
   }
@@ -22160,6 +23373,74 @@ function javaBodyStripsCrAndLf(body2) {
   }
   return cr && lf;
 }
+function javaBodyStripsTemplateDelimiters(body2) {
+  let open = false;
+  let close = false;
+  for (const m of body2.matchAll(/\.\s*(replace|replaceAll)\s*\(\s*(?:"((?:\\.|[^"\\])*)"|'(\\.|[^'\\])')/g)) {
+    const lit = m[2] ?? m[3] ?? "";
+    if (lit === "{") open = true;
+    if (lit === "}") close = true;
+  }
+  return open && close;
+}
+function findJavaTemplateDelimiterWrapperSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const declRe = /^\s*(?:public|private|protected)?\s*(?:static\s+)?(?:final\s+)?(?:String|CharSequence)\s+([A-Za-z_]\w*)\s*\(/;
+  const bodyWindow = 10;
+  const wrappers = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = declRe.exec(lines[i2]);
+    if (!m) continue;
+    let end = Math.min(lines.length, i2 + bodyWindow);
+    for (let j = i2 + 1; j < end; j++) {
+      if (declRe.test(lines[j])) {
+        end = j;
+        break;
+      }
+    }
+    const body2 = lines.slice(i2, end).join("\n");
+    if (javaBodyStripsTemplateDelimiters(body2)) wrappers.add(m[1]);
+  }
+  if (wrappers.size === 0) return sanitizers;
+  const kinds = ["code_injection", "external_taint_escape"];
+  for (const name2 of wrappers) {
+    const assignedCallRe = new RegExp(
+      `\\b([A-Za-z_][A-Za-z0-9_]*)\\s*=\\s*${name2}\\s*\\(`
+    );
+    const bareCallRe = new RegExp(`\\b${name2}\\s*\\(`);
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      if (!bareCallRe.test(lines[i2])) continue;
+      if (declRe.test(lines[i2]) && bareCallRe.test(lines[i2])) continue;
+      sanitizers.push({
+        type: "java_wrapper_template_delim_strip",
+        method: name2,
+        line: i2 + 1,
+        sanitizes: [...kinds]
+      });
+      const am = assignedCallRe.exec(lines[i2]);
+      if (!am) continue;
+      const callIndent = lines[i2].length - lines[i2].trimStart().length;
+      const validated = am[1];
+      const validatedRe = new RegExp(`\\b${validated}\\b`);
+      for (let j = i2 + 1; j < lines.length; j++) {
+        const jline = lines[j];
+        if (jline.trim() === "") continue;
+        const jindent = jline.length - jline.trimStart().length;
+        if (jindent < callIndent) break;
+        if (validatedRe.test(jline)) {
+          sanitizers.push({
+            type: "java_wrapper_template_delim_strip",
+            method: name2,
+            line: j + 1,
+            sanitizes: [...kinds]
+          });
+        }
+      }
+    }
+  }
+  return sanitizers;
+}
 function findCrlfWrapperFunctionSanitizers(code, language) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -24575,6 +25856,79 @@ function findJsLdapInjectionFindings(code, file) {
       snippet: line.trim()
     });
   }
+  const positionalSearchRe = /\.\s*search\s*\(\s*(?:'[^']*'|"[^"]*")\s*,\s*([^,{]+)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    const pm = line.match(positionalSearchRe);
+    if (!pm) continue;
+    const expr = pm[1].trim();
+    if (expr.startsWith("{")) continue;
+    let tainted = false;
+    for (const v of taintedVars) {
+      if (new RegExp(`\\b${v}\\b`).test(expr)) {
+        tainted = true;
+        break;
+      }
+    }
+    if (!tainted) continue;
+    const lineNo = i2 + 1;
+    if (seen.has(lineNo)) continue;
+    seen.add(lineNo);
+    findings.push({
+      id: `ldap_injection-${file}-${lineNo}-js-ldap-positional-filter`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "ldap_injection",
+      cwe: "CWE-90",
+      severity: "critical",
+      level: "error",
+      message: "LDAP injection: ldapjs/ldapts `client.search(base, <tainted-filter>, ...)` lets the attacker break out of the filter expression. Escape user input or use a structured filter builder.",
+      file,
+      line: lineNo,
+      snippet: line.trim()
+    });
+  }
+  return findings;
+}
+function findJsZipHeaderFailopenFindings(code, file) {
+  const findings = [];
+  if (typeof code !== "string" || code.length === 0) return findings;
+  const lines = code.split("\n");
+  const hasPkLocalSig = lines.some((l) => {
+    const t = l.trim();
+    if (t.startsWith("//")) return false;
+    return /0x50/.test(t) && /0x4[bB]/.test(t) && /0x03/.test(t) && /0x04/.test(t);
+  });
+  if (!hasPkLocalSig) return findings;
+  const seen = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const trimmed = lines[i2].trim();
+    if (trimmed.startsWith("//")) continue;
+    const failBranch = trimmed.match(/^if\s*\(\s*!(\w+)\s*\)\s*(.+)$/);
+    if (!failBranch) continue;
+    const tail = failBranch[2];
+    if (/\bthrow\b/.test(tail)) continue;
+    if (!/\breturn\b/.test(tail)) continue;
+    if (!/\.(subarray|slice)\s*\(/.test(tail) && !/Buffer\.from\s*\(/.test(tail)) {
+      continue;
+    }
+    const lineNo = i2 + 1;
+    if (seen.has(lineNo)) continue;
+    seen.add(lineNo);
+    findings.push({
+      id: `input_validation-${file}-${lineNo}-js-zip-header-failopen`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "input_validation",
+      cwe: "CWE-20",
+      severity: "high",
+      level: "error",
+      message: "Input validation fail-open: an invalid ZIP local header check still returns a slice of the caller-controlled buffer. On parse failure, throw or return empty \u2014 do not pass through untrusted bytes.",
+      file,
+      line: lineNo,
+      snippet: trimmed.substring(0, 120)
+    });
+  }
   return findings;
 }
 function findGoLdapInjectionFindings(code, file) {
@@ -25077,6 +26431,40 @@ function findGoGobDeserializationFindings(code, file) {
   }
   return findings;
 }
+function maskJsLiteralsAndComments(code) {
+  const out2 = code.split("");
+  let i2 = 0;
+  const blank = (from, to) => {
+    for (let k = from; k < to; k++) if (out2[k] !== "\n") out2[k] = " ";
+  };
+  while (i2 < code.length) {
+    const c = code[i2];
+    const n = code[i2 + 1];
+    if (c === "/" && n === "/") {
+      let j = i2;
+      while (j < code.length && code[j] !== "\n") j++;
+      blank(i2, j);
+      i2 = j;
+    } else if (c === "/" && n === "*") {
+      const end = code.indexOf("*/", i2 + 2);
+      const j = end < 0 ? code.length : end + 2;
+      blank(i2, j);
+      i2 = j;
+    } else if (c === '"' || c === "'" || c === "`") {
+      let j = i2 + 1;
+      while (j < code.length && code[j] !== c) {
+        if (code[j] === "\\") j++;
+        else if (c !== "`" && code[j] === "\n") break;
+        j++;
+      }
+      blank(i2 + 1, Math.min(j, code.length));
+      i2 = j + 1;
+    } else {
+      i2++;
+    }
+  }
+  return out2.join("");
+}
 function findJsJsonParseBodyFindings(code, file) {
   const findings = [];
   if (typeof code !== "string" || code.length === 0) return findings;
@@ -25110,12 +26498,13 @@ function findJsJsonParseBodyFindings(code, file) {
   }
   const callRe = /\bJSON\s*\.\s*parse\s*\(\s*([^)]+?)\s*\)/g;
   const seen = /* @__PURE__ */ new Set();
+  const codeLines = maskJsLiteralsAndComments(code).split("\n");
   for (let i2 = 0; i2 < lines.length; i2++) {
     const line = lines[i2];
-    if (line.trim().startsWith("//")) continue;
+    const codeLine = codeLines[i2] ?? "";
     callRe.lastIndex = 0;
     let m;
-    while ((m = callRe.exec(line)) !== null) {
+    while ((m = callRe.exec(codeLine)) !== null) {
       const arg = m[1];
       let tainted = reqBodyRe.test(arg);
       if (!tainted) {
@@ -25535,198 +26924,6 @@ function findJavaSpringReturnXSSSinks(code, types, sources, xssSanitizerLines) {
   return out2;
 }
 
-// src/analysis/js-crlf-strip.ts
-var MAX_PATTERN_LENGTH = 200;
-var NEUTRAL_AFTER_REPLACE = /* @__PURE__ */ new Set([
-  "replace",
-  "replaceAll",
-  "trim",
-  "trimStart",
-  "trimEnd",
-  "toString",
-  "toLowerCase",
-  "toUpperCase",
-  "slice",
-  "substring"
-]);
-var PROBE = "a\r\rb\n\nc\r\nd\n\re x	";
-function readQuoted(s, i2) {
-  const q = s[i2];
-  if (q !== '"' && q !== "'" && q !== "`") return null;
-  let out2 = "";
-  for (let j = i2 + 1; j < s.length; j++) {
-    const c = s[j];
-    if (c === q) return { value: out2, end: j + 1 };
-    if (q === "`" && c === "$" && s[j + 1] === "{") return null;
-    if (c === "\\") {
-      const n = s[j + 1];
-      if (n === void 0) return null;
-      switch (n) {
-        case "n":
-          out2 += "\n";
-          j++;
-          continue;
-        case "r":
-          out2 += "\r";
-          j++;
-          continue;
-        case "t":
-          out2 += "	";
-          j++;
-          continue;
-        case "0":
-          out2 += "\0";
-          j++;
-          continue;
-        case "x": {
-          const h = /^[0-9a-fA-F]{2}/.exec(s.slice(j + 2, j + 4));
-          if (!h) return null;
-          out2 += String.fromCharCode(parseInt(h[0], 16));
-          j += 3;
-          continue;
-        }
-        case "u": {
-          const h = /^[0-9a-fA-F]{4}/.exec(s.slice(j + 2, j + 6));
-          if (!h) return null;
-          out2 += String.fromCharCode(parseInt(h[0], 16));
-          j += 5;
-          continue;
-        }
-        default:
-          out2 += n;
-          j++;
-          continue;
-      }
-    }
-    if (c === "\n" && q !== "`") return null;
-    out2 += c;
-  }
-  return null;
-}
-function readRegexLiteral(s, i2) {
-  if (s[i2] !== "/") return null;
-  let inClass = false;
-  for (let j = i2 + 1; j < s.length; j++) {
-    const c = s[j];
-    if (c === "\n") return null;
-    if (c === "\\") {
-      j++;
-      continue;
-    }
-    if (inClass) {
-      if (c === "]") inClass = false;
-      continue;
-    }
-    if (c === "[") {
-      inClass = true;
-      continue;
-    }
-    if (c === "/") {
-      const flags2 = /^[dgimsuvy]*/.exec(s.slice(j + 1))[0];
-      return { source: s.slice(i2 + 1, j), flags: flags2, end: j + 1 + flags2.length };
-    }
-  }
-  return null;
-}
-var skipWs = (s, i2) => {
-  while (i2 < s.length && /\s/.test(s[i2])) i2++;
-  return i2;
-};
-function parseSteps(chainText) {
-  const steps = [];
-  const callRe = /\.\s*(replaceAll|replace)\s*\(/g;
-  let m;
-  while ((m = callRe.exec(chainText)) !== null) {
-    const kind = m[1];
-    let i2 = skipWs(chainText, m.index + m[0].length);
-    let pattern;
-    const rx = readRegexLiteral(chainText, i2);
-    if (rx) {
-      if (rx.source.length > MAX_PATTERN_LENGTH) return null;
-      try {
-        pattern = new RegExp(rx.source, rx.flags);
-      } catch {
-        return null;
-      }
-      i2 = rx.end;
-    } else {
-      const str = readQuoted(chainText, i2);
-      if (!str) return null;
-      pattern = str.value;
-      i2 = str.end;
-    }
-    i2 = skipWs(chainText, i2);
-    if (chainText[i2] !== ",") return null;
-    i2 = skipWs(chainText, i2 + 1);
-    const rep = readQuoted(chainText, i2);
-    if (!rep) return null;
-    i2 = skipWs(chainText, rep.end);
-    if (chainText[i2] !== ")") return null;
-    steps.push({ kind, pattern, replacement: rep.value });
-    callRe.lastIndex = i2 + 1;
-  }
-  return steps;
-}
-function run2(steps, input) {
-  let s = input;
-  try {
-    for (const st of steps) {
-      if (st.kind === "replaceAll" && st.pattern instanceof RegExp && !st.pattern.global) return null;
-      s = st.kind === "replaceAll" ? s.replaceAll(st.pattern, st.replacement) : s.replace(st.pattern, st.replacement);
-    }
-  } catch {
-    return null;
-  }
-  return s;
-}
-function jsReplaceChainVerdict(chainText) {
-  const steps = parseSteps(chainText);
-  if (!steps || steps.length === 0) return "undecided";
-  const first = chainText.search(/\.\s*(?:replaceAll|replace)\s*\(/);
-  for (const seg of chainText.slice(first + 1).matchAll(/\.\s*([A-Za-z_$][\w$]*)\s*\(/g)) {
-    if (!NEUTRAL_AFTER_REPLACE.has(seg[1])) return "undecided";
-  }
-  const out2 = run2(steps, PROBE);
-  if (out2 === null) return "undecided";
-  return out2.includes("\r") || out2.includes("\n") ? "leaves-crlf" : "strips-crlf";
-}
-function jsChainTextAt(sourceLines, line, column) {
-  const text = [(sourceLines[line - 1] ?? "").slice(column), ...sourceLines.slice(line, line + 7)].join("\n");
-  let depth = 0;
-  let prevSig = "";
-  let i2 = 0;
-  for (; i2 < text.length; i2++) {
-    const c = text[i2];
-    if (c === '"' || c === "'" || c === "`") {
-      for (i2++; i2 < text.length && text[i2] !== c; i2++) if (text[i2] === "\\") i2++;
-      prevSig = c;
-      continue;
-    }
-    if (c === "/" && depth > 0 && (prevSig === "(" || prevSig === ",")) {
-      const rx = readRegexLiteral(text, i2);
-      if (rx) {
-        i2 = rx.end - 1;
-        prevSig = "/";
-        continue;
-      }
-    }
-    if (c === "(" || c === "[" || c === "{") {
-      depth++;
-      prevSig = c;
-      continue;
-    }
-    if (c === ")" || c === "]" || c === "}") {
-      if (depth === 0) break;
-      depth--;
-      prevSig = c;
-      continue;
-    }
-    if (depth === 0 && !/[\w$.\s]/.test(c)) break;
-    if (!/\s/.test(c)) prevSig = c;
-  }
-  return text.slice(0, i2);
-}
-
 // src/analysis/constant-propagation/patterns.ts
 var TAINT_PATTERNS = [
   // HTTP Sources (Servlet API)
@@ -26124,13 +27321,35 @@ function dropCSharpObjectCarriedWaypoints(sinks, calls) {
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code, imports) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language, imports);
-  let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  let sinkPatterns = config.sinks.filter((p) => sinkPatternImportApplies(p, imports));
+  sinkPatterns = expandPromisifyAliases(sinkPatterns, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
   const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines, language);
   return { sources, sinks: gatedSinks, sanitizers };
 }
+function isBoundParameterCall(call, pattern, sourceLines) {
+  if (!pattern.requires_import || pattern.type !== "sql_injection") return false;
+  const first = call.arguments[0]?.expression?.trim() ?? "";
+  if (first.startsWith("[") || first.startsWith("{")) return true;
+  const receiver = call.receiver;
+  if (!receiver || !sourceLines || !/^[A-Za-z_$][\w$]*$/.test(receiver)) return false;
+  const assignedFromPrepare = new RegExp(
+    `\\b${receiver.replace(/\$/g, "\\$")}\\s*(?::[^=]+)?=\\s*(?:await\\s+)?[\\w$.]+\\.prepare\\s*\\(`
+  );
+  return sourceLines.some((line) => assignedFromPrepare.test(line));
+}
+function sinkPatternImportApplies(pattern, imports) {
+  const required = pattern.requires_import;
+  if (!required || required.length === 0) return true;
+  if (!imports || imports.length === 0) return false;
+  return imports.some((imp) => {
+    const from = imp.from_package;
+    if (!from) return false;
+    return required.some((m) => from === m || from.startsWith(m + "/"));
+  });
+}
 function sinkPatternAppliesTo(pattern, language) {
   if (language === void 0) return true;
   if (pattern.languages && pattern.languages.length > 0 && !pattern.languages.includes(language)) {
@@ -26548,6 +27767,46 @@ function isInterproceduralTaintableType(typeName, language) {
     const leaf = baseType.split(".").pop() ?? baseType;
     if (csharpTaintable.includes(baseType) || csharpTaintable.includes(leaf)) return true;
   }
+  if (language === "rust") {
+    const trimmed = typeName.trim();
+    const unref = trimmed.replace(/^&mut\s+/, "").replace(/^&\s*/, "");
+    const rustBase = unref.split("<")[0].trim();
+    const rustScalars = [
+      "String",
+      "str",
+      "bool",
+      "char",
+      "i8",
+      "i16",
+      "i32",
+      "i64",
+      "i128",
+      "isize",
+      "u8",
+      "u16",
+      "u32",
+      "u64",
+      "u128",
+      "usize",
+      "f32",
+      "f64"
+    ];
+    if (rustScalars.includes(rustBase)) return true;
+    if (rustBase === "()" || rustBase === "!") return false;
+    if (unref.startsWith("Vec<") || unref.startsWith("Option<") || unref.startsWith("Result<")) {
+      return true;
+    }
+    if (/^[A-Z][A-Za-z0-9_]*$/.test(rustBase)) return true;
+  }
+  if (language === "javascript" || language === "typescript") {
+    const trimmed = typeName.trim();
+    const jsScalars = ["string", "number", "boolean", "bigint", "any", "unknown", "object"];
+    if (jsScalars.includes(baseType)) return true;
+    if (trimmed.startsWith("{") || trimmed.startsWith("[") || trimmed.startsWith("(")) return true;
+    if (/\bRecord\s*</.test(trimmed)) return true;
+    if (["void", "undefined", "null", "never"].includes(baseType)) return false;
+    if (/^[A-Za-z_][\w.$]*$/.test(baseType)) return true;
+  }
   if (typeName.endsWith("[]")) {
     const elementType = typeName.slice(0, -2);
     if (elementType === "String" || elementType === "Object" || elementType === "byte") {
@@ -26662,6 +27921,31 @@ function isSafeGoExecCommandCall(call, pattern, language) {
       return false;
     }
   }
+  if (program === "git") {
+    const subcommandArgPos = pattern.method === "CommandContext" ? 2 : 1;
+    const subcommandArg = call.arguments.find((a) => a.position === subcommandArgPos);
+    let subcommand;
+    if (subcommandArg?.literal !== null && subcommandArg?.literal !== void 0) {
+      subcommand = String(subcommandArg.literal);
+    } else {
+      const expr = (subcommandArg?.expression ?? "").trim();
+      if (expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'")) {
+        subcommand = expr.slice(1, -1);
+      }
+    }
+    if (subcommand === "ls-remote") {
+      const hasEndOfOptions = call.arguments.some((a) => {
+        if (a.literal !== null && a.literal !== void 0) {
+          return String(a.literal) === "--";
+        }
+        const expr = (a.expression ?? "").trim();
+        return expr === '"--"' || expr === "'--'" || expr === "`--`";
+      });
+      if (!hasEndOfOptions) {
+        return false;
+      }
+    }
+  }
   return true;
 }
 function isSafeJSChildProcessCall(call, pattern, language) {
@@ -27065,6 +28349,29 @@ function isRegexReceiver(receiver, sourceLines) {
   const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
   return sourceLines.some((l) => decl.test(l));
 }
+function isNavigationReceiverName(receiver) {
+  const r = (receiver ?? "").trim();
+  if (!r) return false;
+  const last = r.slice(r.lastIndexOf(".") + 1).replace(/\(\)$/, "");
+  return /router|history|navigat|^nav$/i.test(last);
+}
+function isInMemoryMapGetReceiver(receiver, sourceLines) {
+  const raw = (receiver ?? "").trim();
+  if (!raw || !sourceLines) return false;
+  if (/\.properties$/i.test(raw)) return true;
+  const lastDot = raw.lastIndexOf(".");
+  const r = (lastDot >= 0 ? raw.slice(lastDot + 1) : raw).trim();
+  if (/^(properties|memoryCache)$/i.test(r)) return true;
+  if (!/^[A-Za-z_$][\w$]*$/.test(r)) return false;
+  const n = escapeRe(r);
+  const mapCtor = new RegExp(
+    `\\b${n}\\s*(?::[^=;]*)?=\\s*new\\s+(?:Weak)?Map\\s*(?:<.*>)?\\s*\\(`
+  );
+  const mapType = new RegExp(
+    `\\b${n}\\s*\\??\\s*:\\s*(?:Readonly)?(?:Weak)?Map\\s*<`
+  );
+  return sourceLines.some((l) => mapCtor.test(l) || mapType.test(l));
+}
 function isDeclaredFunctionReference(arg, sourceLines) {
   if (arg.literal !== null && arg.literal !== void 0) return false;
   if (!sourceLines) return false;
@@ -27269,6 +28576,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isParameterizedQueryCall(call, pattern)) {
           continue;
         }
+        if ((language === "javascript" || language === "typescript") && (pattern.type === "sql_injection" || pattern.type === "nosql_injection") && call.arguments.length === 0 && pattern.arg_positions.every((p) => p >= 0)) {
+          continue;
+        }
+        if (isBoundParameterCall(call, pattern, sourceLines)) {
+          continue;
+        }
         if (isSafePythonSubprocessCall(call, pattern, language)) {
           continue;
         }
@@ -27326,9 +28639,15 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isArgumentlessJsResponseWriter(call, pattern, language)) {
           continue;
         }
+        if (pattern.type === "open_redirect" && (language === "javascript" || language === "typescript") && (call.method_name === "push" || call.method_name === "replace") && (pattern.class ?? "").toLowerCase() === "router" && !call.receiver_type && !call.receiver_type_fqn && !isNavigationReceiverName(call.receiver)) {
+          continue;
+        }
         if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
+        if (pattern.type === "sql_injection" && call.method_name === "get" && pattern.class === "Connection" && (language === "javascript" || language === "typescript") && isInMemoryMapGetReceiver(call.receiver, sourceLines)) {
+          continue;
+        }
         if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
           continue;
         }
@@ -27345,7 +28664,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
           continue;
         }
         const location = formatCallLocation(call);
-        const key = `${location}:${call.location.line}:${pattern.cwe}`;
+        const key = `${location}:${call.location.line}:${call.location.column}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
@@ -27356,6 +28675,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             cwe: pattern.cwe,
             location,
             line: call.location.line,
+            callColumn: call.location.column,
             confidence,
             method: call.method_name,
             argPositions: pattern.arg_positions,
@@ -27393,6 +28713,15 @@ function matchesSourcePattern(call, pattern, language, types, imports) {
         return false;
       }
     }
+    if (!pattern.class && pattern.return_tainted && pattern.method && (language === "javascript" || language === "typescript")) {
+      const expressRequestAccessors = /* @__PURE__ */ new Set(["query", "body", "params", "headers", "cookies"]);
+      if (expressRequestAccessors.has(pattern.method)) {
+        const recv = call.receiver?.toLowerCase() ?? "";
+        if (recv !== "req" && recv !== "request" && recv !== "ctx") {
+          return false;
+        }
+      }
+    }
     return pattern.return_tainted === true;
   }
   return false;
@@ -27486,6 +28815,7 @@ var SAFE_RECEIVERS_BY_METHOD = {
     "database",
     "sqlite",
     "conn",
+    "con",
     "connection",
     "client",
     "pool",
@@ -27762,7 +29092,7 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       }
     }
   }
-  if (!pattern.class && call.receiver) {
+  if (!pattern.class && call.receiver && !pattern.requires_import) {
     if (isKnownSafeReceiverForMethod(call.receiver, call.method_name, pattern.type)) {
       return false;
     }
@@ -28495,6 +29825,8 @@ function javaReplaceChainCredit(chainText) {
   let lf = false;
   let lt = false;
   let gt = false;
+  let openBrace = false;
+  let closeBrace = false;
   for (const m of chainText.matchAll(JAVA_REPLACE_ARGS_RE)) {
     const kind = m[1];
     const rawFrom = m[2] ?? m[3] ?? "";
@@ -28505,10 +29837,13 @@ function javaReplaceChainCredit(chainText) {
     if (cov.lf) lf = true;
     if (from === "<" && to.startsWith("&")) lt = true;
     if (from === ">" && to.startsWith("&")) gt = true;
+    if (from === "{") openBrace = true;
+    if (from === "}") closeBrace = true;
   }
   const out2 = [];
   if (cr && lf) out2.push("log_injection");
   if (lt && gt) out2.push("xss");
+  if (openBrace && closeBrace) out2.push("code_injection");
   return out2;
 }
 function matchesSanitizerPattern(call, pattern) {
@@ -30220,7 +31555,7 @@ var AnalysisPipeline = class {
     this.passes.push(pass);
     return this;
   }
-  run(graph, code, language, config, resources) {
+  run(graph, code, language, config, resources, limit) {
     const results = /* @__PURE__ */ new Map();
     const findings = [];
     const context = {
@@ -30249,6 +31584,7 @@ var AnalysisPipeline = class {
     };
     const timingEnabled = globalThis.__circleIrPassTiming === true;
     for (const pass of this.passes) {
+      if (limit && Date.now() > limit.deadline) throw limit.onExpired(pass.name);
       if (timingEnabled) {
         console.error(`[pass-start] ${pass.name} file=${graph.ir.meta.file}`);
       }
@@ -31111,10 +32447,49 @@ var JAVA_LANG_EXCEPTION_TYPES = /* @__PURE__ */ new Set([
   "Error",
   "AssertionError"
 ]);
+var JAVA_LANG_STRING_ACCUMULATOR_TYPES = /* @__PURE__ */ new Set(["StringBuilder", "StringBuffer"]);
 var JAVA_FORMATTER_CLASSES = /* @__PURE__ */ new Map([
   ["String", "java.lang"],
   ["MessageFormat", "java.text"]
 ]);
+var JAVA_LOGGER_METHODS = /* @__PURE__ */ new Set([
+  "severe",
+  "warning",
+  "config",
+  "fine",
+  "finer",
+  "finest",
+  "logp",
+  "logrb",
+  "log",
+  "trace",
+  "debug",
+  "info",
+  "warn",
+  "error",
+  "fatal",
+  "Log",
+  "LogInformation",
+  "LogWarning",
+  "LogError",
+  "LogDebug",
+  "LogTrace",
+  "LogCritical",
+  "Information",
+  "Warning",
+  "Verbose",
+  "Fatal",
+  "BeginScope"
+]);
+function isJavaLoggerCall(call) {
+  return JAVA_LOGGER_METHODS.has(call.method_name);
+}
+var JAVA_OBJECTS_CLASS = /* @__PURE__ */ new Map([["Objects", "java.util"]]);
+var JAVA_OBJECTS_NULL_CHECK_METHODS = /* @__PURE__ */ new Set([
+  "requireNonNull",
+  "requireNonNullElse",
+  "requireNonNullElseGet"
+]);
 function isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls) {
   if (call.method_name !== "format" || !call.receiver) return false;
   const needle = `${call.receiver}.format(`;
@@ -31124,6 +32499,10 @@ function isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls) {
   }
   return isJdkClassReceiver(call.receiver, JAVA_FORMATTER_CLASSES, declaredTypeNames, imports);
 }
+function isJavaObjectsNullCheckCall(call, declaredTypeNames, imports) {
+  if (!call.receiver || !JAVA_OBJECTS_NULL_CHECK_METHODS.has(call.method_name)) return false;
+  return isJdkClassReceiver(call.receiver, JAVA_OBJECTS_CLASS, declaredTypeNames, imports);
+}
 function isJdkClassReceiver(receiver, classes, declaredTypeNames, imports) {
   const dot = receiver.lastIndexOf(".");
   const simple = dot < 0 ? receiver : receiver.slice(dot + 1);
@@ -31166,12 +32545,18 @@ var JAVA_CHARACTER_PREDICATES = /* @__PURE__ */ new Set([
   "isBmpCodePoint",
   "isSupplementaryCodePoint"
 ]);
+var JAVA_CHARACTER_METADATA = /* @__PURE__ */ new Set(["getName", "getType", "getNumericValue"]);
 function isJavaCharacterPredicateCall(call, declaredTypeNames, imports) {
-  if (!call.receiver || !JAVA_CHARACTER_PREDICATES.has(call.method_name)) return false;
+  if (!call.receiver) return false;
+  if (!JAVA_CHARACTER_PREDICATES.has(call.method_name) && !JAVA_CHARACTER_METADATA.has(call.method_name)) {
+    return false;
+  }
   return isJdkClassReceiver(call.receiver, JAVA_CHARACTER_CLASS, declaredTypeNames, imports);
 }
 function isJavaNonEscapeCall(call, declaredTypeNames, imports, calls) {
   if (isJavaStaticFormatterCall(call, declaredTypeNames, imports, calls)) return true;
+  if (isJavaObjectsNullCheckCall(call, declaredTypeNames, imports)) return true;
+  if (isJavaLoggerCall(call)) return true;
   if (isJavaCharacterPredicateCall(call, declaredTypeNames, imports)) return true;
   if (call.receiver) return false;
   const isCtor = call.is_constructor === true || (call.resolution?.target ?? "").endsWith(".<init>");
@@ -31179,11 +32564,11 @@ function isJavaNonEscapeCall(call, declaredTypeNames, imports, calls) {
   const written = call.method_name;
   const simple = written.split(".").pop() ?? written;
   if (written.includes(".")) {
-    return written.startsWith("java.lang.") && (JAVA_LANG_EXCEPTION_TYPES.has(simple) || /(Exception|Error)$/.test(simple));
+    return written.startsWith("java.lang.") && (JAVA_LANG_EXCEPTION_TYPES.has(simple) || JAVA_LANG_STRING_ACCUMULATOR_TYPES.has(simple) || /(Exception|Error)$/.test(simple));
   }
   if (call.receiver_type_fqn && !call.receiver_type_fqn.startsWith("java.lang.")) return false;
   if (declaredTypeNames.has(simple)) return false;
-  return JAVA_LANG_EXCEPTION_TYPES.has(simple);
+  return JAVA_LANG_EXCEPTION_TYPES.has(simple) || JAVA_LANG_STRING_ACCUMULATOR_TYPES.has(simple);
 }
 function isGoConstRegexMatchCall(call, graph, calls) {
   if (call.method_name !== "MatchString" || call.arguments.length !== 1) return false;
@@ -31444,6 +32829,14 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
       sanitizerMethods.add(match[1]);
     }
   }
+  const bashScriptFunctions = /* @__PURE__ */ new Set();
+  if (graph.ir.meta.language === "bash") {
+    for (const d of graph.ir.dfg.defs) {
+      if (d.kind === "param" && d.expression?.startsWith("bash-fn:")) {
+        bashScriptFunctions.add(d.expression.slice("bash-fn:".length));
+      }
+    }
+  }
   for (const call of calls) {
     const taintedArgPositions = [];
     const taintedArgVars = [];
@@ -31467,7 +32860,8 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
         }
       }
     }
-    const targetMethod = getMethodNode(methodNodes, call.method_name);
+    const resolvedCalleeFqn = resolveMethodCall2(call, methodNodes, types);
+    const targetMethod = resolvedCalleeFqn ? methodNodes.byFqn.get(resolvedCalleeFqn) : getMethodNode(methodNodes, call.method_name);
     if (!targetMethod) {
       if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
@@ -31501,6 +32895,9 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
         if (isBash && bashSafeBuiltins.has(call.method_name)) {
           continue;
         }
+        if (isBash && bashScriptFunctions.has(call.method_name)) {
+          continue;
+        }
         if (isBash && taintedArgPositions.length > 0) {
           const terminatorPos = call.arguments.filter((a) => a.expression === "--").map((a) => a.position).reduce((min, p) => min === null || p < min ? p : min, null);
           const earliestTainted = Math.min(...taintedArgPositions);
@@ -31558,6 +32955,12 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
         if (pos < targetMethod.parameters.length) {
           targetMethod.parameters[pos].isTainted = true;
           targetMethod.parameters[pos].sourceLine = call.location.line;
+          const paramName = targetMethod.parameters[pos].name;
+          for (const def of graph.ir.dfg.defs) {
+            if (def.kind === "param" && def.variable === paramName && def.line >= targetMethod.startLine && def.line <= targetMethod.endLine) {
+              taintedDefIds.add(def.id);
+            }
+          }
         }
       }
       taintedMethods.add(targetMethod.fqn);
@@ -32942,6 +34345,9 @@ var ConstantPropagator = class _ConstantPropagator {
       case "assignment_statement":
         this.handleGoAssignment(node);
         return false;
+      case "var_declaration":
+        this.handleGoVarDeclaration(node);
+        return false;
       case "update_expression":
         this.handleUpdateExpression(node);
         return false;
@@ -33349,6 +34755,64 @@ var ConstantPropagator = class _ConstantPropagator {
    * helper that always returns a constant — clears the variable. Anything else stops being tracked here, which is what Go
    * assignments got before this handler existed: the DFG decides.
    */
+  /** `var x = expr` / `var x T = expr` — same clean/taint rules as `:=` (#783). */
+  handleGoVarDeclaration(node) {
+    for (let i2 = 0; i2 < node.childCount; i2++) {
+      const spec = node.child(i2);
+      if (!spec || spec.type !== "var_spec") continue;
+      const nameNode = spec.childForFieldName("name");
+      let valueNode = spec.childForFieldName("value");
+      if (!nameNode || !valueNode) continue;
+      const names = [];
+      if (nameNode.type === "identifier") {
+        names.push(getNodeText2(nameNode, this.source));
+      } else if (nameNode.type === "identifier_list") {
+        for (const c of nameNode.children) {
+          if (c.type === "identifier") names.push(getNodeText2(c, this.source));
+        }
+      }
+      if (valueNode.type === "expression_list") {
+        valueNode = valueNode.children.find((c) => c.type !== "," && c.type !== "comment") ?? valueNode;
+      }
+      if (names.length === 0) continue;
+      const line = getNodeLine(node);
+      for (const varName of names) {
+        if (varName === "_") continue;
+        const scopedName = this.getScopedName(varName);
+        this.goScopedNames.add(scopedName);
+        if (this.isTaintedExpression(valueNode)) {
+          this.goUnknownVars.add(scopedName);
+          this.tainted.add(scopedName);
+          this.sanitizedVars.delete(scopedName);
+          this.sanitizedVarUncovered.delete(scopedName);
+          this.definitionNodes.set(scopedName, valueNode);
+          this.symbols.set(scopedName, createUnknown(line));
+          continue;
+        }
+        if (!this.isGoKnownCleanRhs(valueNode) || this.goUnknownVars.has(scopedName)) {
+          this.goUnknownVars.add(scopedName);
+          this.symbols.delete(scopedName);
+          this.sanitizedVars.delete(scopedName);
+          this.sanitizedVarUncovered.delete(scopedName);
+          if (!this.inConditionalBranch) {
+            this.tainted.delete(scopedName);
+            this.definitionNodes.delete(scopedName);
+          }
+          continue;
+        }
+        if (this.inConditionalBranch) {
+          this.goUnknownVars.add(scopedName);
+          this.symbols.delete(scopedName);
+          continue;
+        }
+        this.tainted.delete(scopedName);
+        this.definitionNodes.delete(scopedName);
+        this.symbols.set(scopedName, this.evaluateExpression(valueNode));
+        this.sanitizedVars.delete(scopedName);
+        this.sanitizedVarUncovered.delete(scopedName);
+      }
+    }
+  }
   handleGoAssignment(node) {
     const left = node.childForFieldName("left");
     const right = node.childForFieldName("right");
@@ -34165,6 +35629,24 @@ var ConstantPropagator = class _ConstantPropagator {
     cache.set(rootId, false);
     return false;
   }
+  /** Is an argument of `call` an inline sanitizer call over tainted input (itself possibly nested)? */
+  argIsSanitizedTaint(call) {
+    const argsNode = call.childForFieldName("arguments");
+    if (!argsNode) return false;
+    for (const arg of argsNode.children) {
+      if (arg.type !== "method_invocation") continue;
+      const name2 = arg.childForFieldName("name");
+      if (!name2 || !SANITIZER_METHODS.has(getNodeText2(name2, this.source))) continue;
+      const inner = arg.childForFieldName("arguments");
+      if (!inner) continue;
+      for (const a of inner.children) {
+        if (a.type === "(" || a.type === ")" || a.type === ",") continue;
+        if (this.isTaintedExpression(a)) return true;
+      }
+      if (this.argIsSanitizedTaint(arg)) return true;
+    }
+    return false;
+  }
   isTaintedExpressionStep(node) {
     const text = getNodeText2(node, this.source);
     if (node.type === "method_invocation") {
@@ -34172,6 +35654,9 @@ var ConstantPropagator = class _ConstantPropagator {
       const objectNode = node.childForFieldName("object");
       if (nameNode) {
         const methodName = getNodeText2(nameNode, this.source);
+        if (ANTI_SANITIZER_METHODS.has(methodName) && this.argIsSanitizedTaint(node)) {
+          return true;
+        }
         if (SANITIZER_METHODS.has(methodName) && !this.localNonSanitizing.has(methodName)) {
           return false;
         }
@@ -35147,6 +36632,8 @@ function classifyEntryPointTier(method, enclosingType, ctx) {
       return classifyJsTsEntryPoint(method, enclosingType, ctx);
     case "go":
       return classifyGoEntryPoint(method, enclosingType, ctx);
+    case "csharp":
+      return classifyCSharpEntryPoint(method, enclosingType, ctx);
     case "bash":
     case "shell":
       return classifyBashEntryPoint(method, enclosingType, ctx);
@@ -35399,6 +36886,84 @@ function fileHasJsTsFrameworkRegistration(regs) {
   }
   return false;
 }
+var CSHARP_TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
+  "HttpGet",
+  "HttpPost",
+  "HttpPut",
+  "HttpDelete",
+  "HttpPatch",
+  "HttpHead",
+  "HttpOptions",
+  "Route",
+  "AcceptVerbs",
+  "MapGet",
+  "MapPost",
+  "MapPut",
+  "MapDelete",
+  "MapPatch"
+]);
+var CSHARP_TIER_1_PARAM_ANNOTATIONS = /* @__PURE__ */ new Set([
+  "FromQuery",
+  "FromBody",
+  "FromRoute",
+  "FromHeader",
+  "FromForm",
+  "FromServices"
+]);
+var CSHARP_TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
+  "ApiController",
+  "Controller",
+  "Route"
+]);
+var CSHARP_MVC_BASE_SIMPLE_NAMES = /* @__PURE__ */ new Set([
+  "Controller",
+  "ControllerBase",
+  "PageModel"
+]);
+function csharpBaseTypeLooksLikeMvc(base) {
+  const simple = (base.split(".").pop() ?? base).trim();
+  if (CSHARP_MVC_BASE_SIMPLE_NAMES.has(simple)) return true;
+  return simple.endsWith("Controller") && simple !== "Controller";
+}
+function csharpTypeLooksLikeController(enclosingType) {
+  if (!enclosingType) return false;
+  if (annotationsInclude(enclosingType.annotations, CSHARP_TIER_1_CLASS_ANNOTATIONS)) return true;
+  if (enclosingType.extends && csharpBaseTypeLooksLikeMvc(enclosingType.extends)) return true;
+  const name2 = enclosingType.name ?? "";
+  if (csharpBaseTypeLooksLikeMvc(name2)) return true;
+  return name2.endsWith("Controller") && name2 !== "Controller";
+}
+function csharpMethodHasMvcBindingParams(method) {
+  for (const p of method.parameters ?? []) {
+    if (annotationsInclude(p.annotations, CSHARP_TIER_1_PARAM_ANNOTATIONS)) return true;
+  }
+  return false;
+}
+function looksLikeCSharpMain(method) {
+  const mods = method.modifiers ?? [];
+  if (!mods.includes("static")) return false;
+  if (method.name !== "Main") return false;
+  const params = method.parameters ?? [];
+  return params.length === 0 || params.length === 1 && /\bstring\s*\[\s*\]/.test(params[0]?.type ?? "");
+}
+function classifyCSharpEntryPoint(method, enclosingType, ctx) {
+  if (pathLooksLikeLibraryOrTest(ctx.filePath)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (annotationsInclude(method.annotations, CSHARP_TIER_1_METHOD_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (csharpMethodHasMvcBindingParams(method)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (csharpTypeLooksLikeController(enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (looksLikeCSharpMain(method)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_3_LIBRARY_API";
+}
 var GO_HTTP_REGISTRAR_METHODS = /* @__PURE__ */ new Set([
   // net/http
   "HandleFunc",
@@ -39007,6 +40572,10 @@ var CSharpCredit = class {
     if (type === "path_traversal") {
       if (/\b([A-Za-z_]\w*)\s*\.\s*StartsWith\s*\([^)]*\)\s*\?\s*\1\s*:\s*null\b/.test(text)) return true;
     }
+    if (type === "open_redirect") {
+      if (/\b(?:Url\s*\.\s*)?IsLocalUrl\s*\(/.test(text)) return true;
+      if (/\bLocalRedirect\s*\(/.test(text)) return true;
+    }
     return false;
   }
   /**
@@ -39020,6 +40589,10 @@ var CSharpCredit = class {
     const set = /* @__PURE__ */ new Set();
     this.helperCache.set(type, set);
     for (const m of this.methods) {
+      if (type === "open_redirect" && this.openRedirectHelperMethod(m)) {
+        set.add(m.name);
+        continue;
+      }
       const returns = this.returnExprs(m);
       if (returns.length === 0) continue;
       const ok = returns.every((r) => {
@@ -39031,6 +40604,23 @@ var CSharpCredit = class {
     }
     return set;
   }
+  /**
+   * Same-file helper whose returns are safe for open_redirect: literal fallbacks
+   * and parameters returned only under `Url.IsLocalUrl` (cognium-dev#946).
+   */
+  openRedirectHelperMethod(m) {
+    const returns = this.returnExprs(m);
+    if (returns.length === 0) return false;
+    for (const r of returns) {
+      const e = r.expr.trim();
+      if (/^"[^"]*"$/.test(e) || /^'[^']*'$/.test(e)) continue;
+      if (this.builtinSanitizes("open_redirect", e)) continue;
+      const id = /^([A-Za-z_]\w*)$/.exec(e);
+      if (!id) return false;
+      if (!this.guardedVarsAt("open_redirect", r.line).has(id[1])) return false;
+    }
+    return true;
+  }
   /** Every returned expression of a method: `return e;` and expression bodies. */
   returnExprs(m) {
     const out2 = [];
@@ -39263,6 +40853,14 @@ var CSharpCredit = class {
     }
     return out2;
   }
+  /** Variables proven local by `Url.IsLocalUrl(x)` (cognium-dev#275/#946). */
+  localUrlVars(cond) {
+    const out2 = [];
+    for (const m of cond.matchAll(/\b(?:Url\s*\.\s*)?IsLocalUrl\s*\(\s*([A-Za-z_]\w*)\s*\)/g)) {
+      out2.push(m[1]);
+    }
+    return out2;
+  }
   /** Variables whose host a condition compares against a constant or an allowlist. */
   hostVars(cond, hostOf) {
     const out2 = [];
@@ -39304,7 +40902,7 @@ var CSharpCredit = class {
     return map;
   }
   provenBy(kind, cond, parsedFrom, hostOf, withHelpers) {
-    const out2 = kind === "allowlist" ? this.allowlistVars(cond) : kind === "numeric" ? this.numericVars(cond, parsedFrom) : this.hostVars(cond, hostOf);
+    const out2 = kind === "allowlist" ? this.allowlistVars(cond) : kind === "numeric" ? this.numericVars(cond, parsedFrom) : kind === "localUrl" ? this.localUrlVars(cond) : this.hostVars(cond, hostOf);
     if (withHelpers) {
       for (const [name2, pos] of this.guardHelpers(kind)) {
         for (const call of cond.matchAll(new RegExp(`(?<![\\w.])${escapeRegex(name2)}\\s*\\(`, "g"))) {
@@ -39334,6 +40932,7 @@ var CSharpCredit = class {
     const kinds = [];
     if (INERT_WHEN_ALPHANUMERIC.has(type)) kinds.push("allowlist", "numeric");
     if (type === "ssrf") kinds.push("host");
+    if (type === "open_redirect") kinds.push("localUrl");
     const proven = /* @__PURE__ */ new Set();
     if (kinds.length === 0) return proven;
     const scopeStart = this.methodAt(sinkLine)?.start_line ?? 1;
@@ -39576,6 +41175,15 @@ var InterproceduralPass = class {
           }
         }
       }
+      appendCalleeSourceCallerSinkFlows(
+        graph,
+        sources,
+        sinks,
+        interProc,
+        additionalFlows,
+        language === "java" ? ctx.code : void 0,
+        language === "java" ? constProp : void 0
+      );
       const taintBridges = findTaintBridges(interProc);
       interprocedural = {
         tainted_methods: Array.from(interProc.taintedMethods),
@@ -39701,6 +41309,401 @@ var InterproceduralPass = class {
     return { additionalSinks: filteredAdditionalSinks, additionalFlows: filteredAdditionalFlows, interprocedural };
   }
 };
+function assigneeIsConstPropClean(constProp, method, variable) {
+  if (!method) return false;
+  const scoped = `${method}:${variable}`;
+  if (!constProp.symbols.has(scoped)) return false;
+  if (constProp.tainted.has(scoped)) return false;
+  for (const t of constProp.tainted) {
+    if (t.startsWith(`${method}:`) && t.endsWith(`:${variable}`)) return false;
+  }
+  if (constProp.sanitizedVarUncovered?.has(scoped)) return false;
+  return true;
+}
+function constPropTaints(constProp, method, variable) {
+  if (constProp.tainted.has(`${method}:${variable}`)) return true;
+  for (const t of constProp.tainted) {
+    if (t.startsWith(`${method}:`) && t.endsWith(`:${variable}`)) return true;
+  }
+  return false;
+}
+function callArgumentIsConstPropTainted(graph, constProp, method, line) {
+  if (!method) return false;
+  for (const call of graph.ir.calls) {
+    if (call.location.line !== line) continue;
+    for (const arg of call.arguments) {
+      const names = arg.variable ? [arg.variable] : (arg.expression ?? "").match(/[A-Za-z_]\w*/g) ?? [];
+      if (names.some((n) => constPropTaints(constProp, method, n))) return true;
+    }
+  }
+  return false;
+}
+function calleeReturnsTaintedContainer(constProp, code, startLine, endLine) {
+  const lines = code.split("\n");
+  for (let l = startLine; l <= endLine; l++) {
+    const m = /^\s*return\s+([A-Za-z_]\w*)\s*;/.exec(lines[l - 1] ?? "");
+    if (!m) continue;
+    if ((constProp.taintedArrayElements.get(m[1])?.size ?? 0) > 0) return true;
+    if ((constProp.taintedCollections.get(m[1])?.size ?? 0) > 0) return true;
+  }
+  return false;
+}
+var DEAD_BRANCH_CHECKED_SINKS = /* @__PURE__ */ new Set([
+  "sql_injection",
+  "trust_boundary",
+  "path_traversal",
+  "ldap_injection",
+  "xpath_injection"
+]);
+function calleeSourceReachesReturn(graph, code, startLine, endLine, sourceLine) {
+  const lines = code.split("\n");
+  const returnLines = /* @__PURE__ */ new Set();
+  for (let l = startLine; l <= endLine; l++) {
+    if (/^\s*return\b/.test(lines[l - 1] ?? "")) returnLines.add(l);
+  }
+  if (returnLines.size === 0) return true;
+  if (returnLines.has(sourceLine)) return true;
+  const inRange = (l) => l >= startLine && l <= endLine;
+  const ends = (l) => /[;{}]\s*$/.test((lines[l - 1] ?? "").replace(/\/\/.*$/, "").trimEnd());
+  const statementStart = (l) => {
+    let s = l;
+    while (s > startLine && !ends(s - 1) && (lines[s - 2] ?? "").trim() !== "") s--;
+    return s;
+  };
+  const reached = new Set(
+    graph.ir.dfg.defs.filter((d) => d.line === sourceLine && d.kind === "local").map((d) => d.id)
+  );
+  if (reached.size === 0) return true;
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const u of graph.ir.dfg.uses) {
+      if (u.def_id === null || !reached.has(u.def_id) || !inRange(u.line)) continue;
+      const stmt = statementStart(u.line);
+      if (returnLines.has(u.line) || returnLines.has(stmt)) return true;
+      for (const d of graph.ir.dfg.defs) {
+        if ((d.line === u.line || d.line === stmt) && d.kind === "local" && !reached.has(d.id)) {
+          reached.add(d.id);
+          changed = true;
+        }
+      }
+      const base = storeBase(lines[stmt - 1] ?? "");
+      if (base && base !== u.variable) {
+        for (const b of graph.ir.dfg.uses) {
+          if ((b.line === u.line || b.line === stmt) && b.variable === base && b.def_id !== null && !reached.has(b.def_id)) {
+            reached.add(b.def_id);
+            changed = true;
+          }
+        }
+      }
+    }
+  }
+  return false;
+}
+function storeBase(line) {
+  const m = /^\s*([A-Za-z_]\w*)\s*(?:\[[^\]=]*\]\s*)+=(?!=)/.exec(line) ?? /^\s*([A-Za-z_]\w*)\s*\.\s*[A-Za-z_]\w*\s*=(?!=)/.exec(line);
+  if (!m || m[1] === "this") return null;
+  return m[1];
+}
+function appendCalleeSourceCallerSinkFlows(graph, sources, sinks, interProc, additionalFlows, fileCode, constProp) {
+  const types = graph.ir.types ?? [];
+  for (const edge of interProc.callEdges) {
+    const callee = interProc.methodNodes.get(edge.calleeMethod);
+    if (!callee) continue;
+    const calleeSources = sources.filter(
+      (s) => s.line >= callee.startLine && s.line <= callee.endLine && (!fileCode || s.type === "interprocedural_param" || calleeSourceReachesReturn(graph, fileCode, callee.startLine, callee.endLine, s.line))
+    );
+    if (calleeSources.length === 0) continue;
+    const assignee = graph.ir.dfg.defs.find(
+      (d) => d.line === edge.callLine && d.kind === "local"
+    );
+    if (!assignee?.variable) continue;
+    if (constProp && callArgumentIsConstPropTainted(graph, constProp, edge.callerMethod, edge.callLine) && assigneeIsConstPropClean(constProp, edge.callerMethod, assignee.variable) && !(fileCode && calleeReturnsTaintedContainer(constProp, fileCode, callee.startLine, callee.endLine))) {
+      continue;
+    }
+    const derivedLocals = localsDerivedFromAssignee(
+      graph,
+      assignee.variable,
+      assignee.line
+    );
+    for (const sink of sinks) {
+      if (sink.type === "external_taint_escape") continue;
+      if (sink.line <= edge.callLine) continue;
+      if (enclosingMethodName(types, sink.line) !== edge.callerMethod) continue;
+      const sinkVar = sinkVariableConsumingDerived(graph, sink, derivedLocals);
+      if (!sinkVar) continue;
+      if (additionalFlows.some((f) => f.source_line === calleeSources[0].line && f.sink_line === sink.line)) {
+        continue;
+      }
+      const source = calleeSources[0];
+      if (fileCode && source.type === "interprocedural_param" && source.variable && DEAD_BRANCH_CHECKED_SINKS.has(sink.type) && interproceduralParamReachIsDeadBranchOnly(
+        fileCode,
+        callee.startLine,
+        callee.endLine,
+        source.variable,
+        assignee.variable
+      )) {
+        continue;
+      }
+      if (fileCode && HELPER_RETURN_GATED_SINKS.has(sink.type) && calleeSources.every(
+        (s) => (s.type === "interprocedural_param" || s.type === "plugin_param") && !!s.variable
+      ) && !calleeReturnMayCarryParam(
+        fileCode,
+        callee.startLine,
+        callee.endLine,
+        calleeSources.map((s) => s.variable)
+      )) {
+        continue;
+      }
+      additionalFlows.push({
+        source_line: source.line,
+        sink_line: sink.line,
+        source_type: source.type,
+        sink_type: sink.type,
+        path: [
+          { variable: source.location, line: source.line, type: "source" },
+          { variable: assignee.variable, line: edge.callLine, type: "use" },
+          { variable: sinkVar, line: sink.line, type: "sink" }
+        ],
+        confidence: sink.confidence * source.confidence * 0.85,
+        sanitized: false
+      });
+    }
+  }
+}
+function interproceduralParamReachIsDeadBranchOnly(code, startLine, endLine, paramName, localName) {
+  if (paramName === localName) return false;
+  const lines = code.split("\n");
+  const slice = lines.slice(startLine - 1, endLine);
+  const sliceText = slice.join("\n");
+  const dead = computeDeadJavaBranchLines(slice);
+  const onLivePaths = buildJavaTaintedVars(sliceText, /* @__PURE__ */ new Set([paramName]), dead);
+  const ifDeadLinesCount = buildJavaTaintedVars(sliceText, /* @__PURE__ */ new Set([paramName]), /* @__PURE__ */ new Set());
+  return ifDeadLinesCount.has(localName) && !onLivePaths.has(localName);
+}
+var HELPER_RETURN_GATED_SINKS = /* @__PURE__ */ new Set([
+  "sql_injection",
+  "trust_boundary",
+  "command_injection",
+  "path_traversal",
+  // #976: the same helper shapes feed LDAP and XPath sinks (OWASP ldapi/xpathi).
+  "ldap_injection",
+  "xpath_injection"
+]);
+function calleeReturnMayCarryParam(code, startLine, endLine, sourceVars) {
+  const raw = code.split("\n").slice(startLine - 1, endLine);
+  const paramNames = [...sourceVars, ...javaMethodParamNames(raw)];
+  const dead = computeDeadJavaBranchLines(raw);
+  const inlined = /* @__PURE__ */ new Set();
+  const slice = joinWrappedStatements(raw, inlined);
+  const text = slice.join("\n");
+  const seeds = new Set(paramNames);
+  const mutated = /* @__PURE__ */ new Set();
+  let live = new Set(seeds);
+  for (let round = 0; round < 8; round++) {
+    live = /* @__PURE__ */ new Set([...seeds, ...buildJavaTaintedVars(text, seeds, dead, { trackSlots: true }).keys()]);
+    let grew = false;
+    for (let i2 = 0; i2 < slice.length; i2++) {
+      if (dead.has(i2)) continue;
+      for (const call of slice[i2].matchAll(/([A-Za-z_]\w*)\s*\.\s*[A-Za-z_]\w*\s*\(([^;]*)\)/g)) {
+        if (live.has(call[1])) continue;
+        const args2 = call[2].replace(/"(?:[^"\\]|\\.)*"/g, " ").match(/[\p{L}\p{N}_]+/gu) ?? [];
+        if (args2.some((t) => live.has(t))) {
+          seeds.add(call[1]);
+          mutated.add(call[1]);
+          grew = true;
+        }
+      }
+      const store = /^\s*([A-Za-z_]\w*)\s*(?:(?:\[[^\]=]*\]\s*)+|\.\s*[A-Za-z_]\w*\s*)=(?!=)\s*(.*?);?\s*$/.exec(slice[i2]);
+      if (store && store[1] !== "this" && !live.has(store[1])) {
+        const rhs = store[2].replace(/"(?:[^"\\]|\\.)*"/g, " ").match(/[\p{L}\p{N}_]+/gu) ?? [];
+        if (rhs.some((t) => live.has(t))) {
+          seeds.add(store[1]);
+          mutated.add(store[1]);
+          grew = true;
+        }
+      }
+    }
+    if (!grew) break;
+  }
+  let sawReturn = false;
+  for (let i2 = 0; i2 < slice.length; i2++) {
+    if (dead.has(i2) || !/^\s*return\b/.test(slice[i2])) continue;
+    const m = /^\s*return\b\s*(.*?)\s*;\s*(?:\/\/.*)?$/.exec(slice[i2]);
+    if (!m) return true;
+    sawReturn = true;
+    const expr = m[1];
+    const bare = /^[A-Za-z_]\w*$/.test(expr) ? expr : null;
+    if (bare && mutated.has(bare)) return true;
+    if (bare && live.has(bare)) {
+      const def = mustReachingAssignment(slice, dead, i2, bare, inlined);
+      if (!def) return true;
+      const upTo = slice.slice(0, def.line);
+      upTo.push(`__helperReturn = ${def.rhs};`);
+      const atDef = buildJavaTaintedVars(upTo.join("\n"), seeds, dead, { trackSlots: true });
+      if (atDef.has("__helperReturn")) return true;
+      continue;
+    }
+    const idents = expr.replace(/"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ").match(/[\p{L}\p{N}_]+/gu) ?? [];
+    if (idents.some((t) => live.has(t))) return true;
+  }
+  return !sawReturn;
+}
+function javaMethodParamNames(lines) {
+  const header = lines.join("\n").split("{")[0];
+  const open = header.indexOf("(");
+  if (open < 0) return [];
+  let depth = 0;
+  let end = -1;
+  for (let k = open; k < header.length; k++) {
+    if (header[k] === "(") depth++;
+    else if (header[k] === ")" && --depth === 0) {
+      end = k;
+      break;
+    }
+  }
+  if (end < 0) return [];
+  const names = [];
+  let angle = 0;
+  let piece = "";
+  for (const c of header.slice(open + 1, end) + ",") {
+    if (c === "<") angle++;
+    else if (c === ">") angle--;
+    if (c === "," && angle === 0) {
+      const m = /([A-Za-z_]\w*)\s*(?:\[\s*\])*\s*$/.exec(piece.trim());
+      if (m) names.push(m[1]);
+      piece = "";
+    } else piece += c;
+  }
+  return names;
+}
+function joinWrappedStatements(lines, inlined) {
+  const out2 = [...lines];
+  const ends = /[;{}:]\s*(?:\/\/.*)?$/;
+  const header = /^\s*(?:if|else|for|while|do|switch|case|default|try|catch|finally|synchronized)\b|^\s*@|^\s*(?:\/\/|\/?\*)/;
+  for (let i2 = 0; i2 < out2.length; i2++) {
+    const line = out2[i2];
+    if (line.trim() === "" || ends.test(line) || header.test(line)) continue;
+    let joined = line;
+    let j = i2 + 1;
+    for (; j < out2.length && j < i2 + 15; j++) {
+      joined += " " + out2[j].trim();
+      if (ends.test(out2[j])) break;
+    }
+    if (j >= out2.length || j >= i2 + 15) continue;
+    out2[i2] = joined;
+    for (let k = i2 + 1; k <= j; k++) out2[k] = "";
+    i2 = j;
+  }
+  return out2.map((line, i2) => {
+    const body2 = inlineControlBody(line);
+    if (body2 !== line) inlined.add(i2);
+    return body2;
+  });
+}
+function inlineControlBody(line) {
+  let rest = line;
+  const indent = /^\s*/.exec(line)[0];
+  for (let guard = 0; guard < 4; guard++) {
+    const t = rest.trimStart();
+    const elseM = /^(?:\}\s*)?else\b\s*/.exec(t);
+    if (elseM && !/^(?:\}\s*)?else\s+if\b/.test(t)) {
+      rest = t.slice(elseM[0].length);
+      continue;
+    }
+    const head = /^(?:\}\s*)?(?:else\s+)?(?:if|for|while)\s*\(/.exec(t);
+    if (!head) break;
+    let depth = 1;
+    let k = head[0].length;
+    for (; k < t.length && depth > 0; k++) {
+      if (t[k] === "(") depth++;
+      else if (t[k] === ")") depth--;
+    }
+    if (depth !== 0) return line;
+    rest = t.slice(k);
+  }
+  const body2 = rest.trim();
+  if (body2 === "" || body2 === rest.trim() && body2 === line.trim() || body2.startsWith("{")) return line;
+  return indent + body2;
+}
+function mustReachingAssignment(slice, dead, retLine, name2, inlined) {
+  const depth = [];
+  let d = 0;
+  for (const line of slice) {
+    depth.push(d);
+    const code = line.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''").replace(/\/\/.*$/, "");
+    for (const c of code) {
+      if (c === "{") d++;
+      else if (c === "}") d--;
+    }
+  }
+  const target = depth[retLine];
+  const esc = name2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const assign = new RegExp(`^\\s*(?:(?:final\\s+)?[A-Za-z_][\\w.]*(?:\\s*<[^>]*>)?(?:\\s*\\[\\s*\\])*\\s+)?${esc}\\s*=\\s*(.+?);\\s*(?://.*)?$`);
+  const mentionsAssign = new RegExp(`(?<![\\w.])${esc}\\s*=(?!=)`);
+  for (let j = retLine - 1; j >= 0; j--) {
+    if (depth[j] < target) return null;
+    if (dead.has(j)) continue;
+    if (!mentionsAssign.test(slice[j])) continue;
+    if (depth[j] > target || inlined.has(j)) return null;
+    const m = assign.exec(slice[j]);
+    if (!m) return null;
+    return { line: j, rhs: m[1] };
+  }
+  return null;
+}
+function localsDerivedFromAssignee(graph, seedVar, seedLine) {
+  const defs = graph.ir.dfg.defs;
+  const chains = graph.ir.dfg.chains ?? [];
+  const seedDefs = defs.filter(
+    (d) => d.variable === seedVar && d.line === seedLine && d.kind === "local"
+  );
+  if (seedDefs.length === 0) return /* @__PURE__ */ new Set([seedVar]);
+  const defIds = new Set(seedDefs.map((d) => d.id));
+  const frontier = seedDefs.map((d) => d.id);
+  const visited = new Set(frontier);
+  while (frontier.length > 0) {
+    const cur = frontier.shift();
+    for (const ch of chains) {
+      if (ch.from_def !== cur || visited.has(ch.to_def)) continue;
+      visited.add(ch.to_def);
+      defIds.add(ch.to_def);
+      frontier.push(ch.to_def);
+    }
+  }
+  const names = /* @__PURE__ */ new Set([seedVar]);
+  for (const d of defs) {
+    if (d.variable && defIds.has(d.id)) names.add(d.variable);
+  }
+  return names;
+}
+function sinkVariableConsumingDerived(graph, sink, derived) {
+  for (const u of graph.usesAtLine(sink.line)) {
+    if (u.variable && derived.has(u.variable)) return u.variable;
+  }
+  for (const call of graph.callsByLine.get(sink.line) ?? []) {
+    for (const arg of call.arguments ?? []) {
+      if (arg.variable && derived.has(arg.variable)) return arg.variable;
+      if (arg.expression) {
+        for (const v of derived) {
+          const re = new RegExp(`\\b${v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+          if (re.test(arg.expression)) return v;
+        }
+      }
+    }
+  }
+  return void 0;
+}
+function enclosingMethodName(types, line) {
+  for (const type of types) {
+    for (const method of type.methods) {
+      if (line >= method.start_line && line <= method.end_line) {
+        return method.name;
+      }
+    }
+  }
+  return null;
+}
 function csharpParamReachesSink(code, method, taintedArgs, sink, credit) {
   const lines = code.split(/\r?\n/);
   const params = taintedArgs.length > 0 ? method.parameters.filter((p) => taintedArgs.includes(p.position)) : method.parameters;
@@ -40441,12 +42444,26 @@ var ConstantPropagationPass = class {
         }
       }
     }
-    return analyzeConstantPropagation(this.tree, code, {
+    const result = analyzeConstantPropagation(this.tree, code, {
       sanitizerMethods: taintMatcher.sanitizerMethods,
       taintedParameters
     });
+    if (ctx.language === "java") pruneDeadChains(ctx, result.unreachableLines);
+    return result;
   }
 };
+function pruneDeadChains(ctx, unreachable) {
+  if (unreachable.size === 0) return;
+  const dfg = ctx.graph.ir.dfg;
+  if (!dfg.chains || dfg.chains.length === 0) return;
+  const lines = ctx.code.split("\n");
+  const dead = /* @__PURE__ */ new Set();
+  for (const d of dfg.defs) {
+    if (unreachable.has(d.line) && !/\?[^?.:]*:/.test(lines[d.line - 1] ?? "")) dead.add(d.id);
+  }
+  if (dead.size === 0) return;
+  dfg.chains = dfg.chains.filter((c) => !dead.has(c.from_def) && !dead.has(c.to_def));
+}
 
 // src/analysis/passes/source-semantics-pass.ts
 var DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
@@ -40933,13 +42950,123 @@ function argvFirstLiteralIsShell(lineText) {
   const base = m[1].split(/[\\/]/).pop().replace(/\.exe$/i, "").toLowerCase();
   return SHELL_PROGRAMS.has(base);
 }
-function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, calls) {
+function javaLocalInitRhsBeforeLine(varName, beforeLine, methodStart, methodEnd, sourceLines) {
+  const declAssign = new RegExp(
+    `^\\s*(?:final\\s+)?[\\w<>,\\s\\[\\]]+\\s+${escapeReSf(varName)}\\s*=\\s*(.+?)\\s*;\\s*(?://.*)?$`
+  );
+  const reassign = new RegExp(`^\\s*${escapeReSf(varName)}\\s*=\\s*(.+?)\\s*;\\s*(?://.*)?$`);
+  let lastRhs;
+  for (let l = methodStart; l < beforeLine && l <= methodEnd; l++) {
+    const line = (sourceLines[l - 1] ?? "").trim();
+    const m = declAssign.exec(line) ?? reassign.exec(line);
+    if (m) lastRhs = m[1].trim();
+  }
+  return lastRhs;
+}
+function callArgLooksLikeShellArgv(expr, probePrefix) {
+  return argvFirstLiteralIsShell(`${probePrefix}${expr}`);
+}
+function parseSimpleJavaCall(expr) {
+  const trimmed = expr.trim();
+  const m = /^([\w][\w.]*)\s*\(/.exec(trimmed);
+  if (!m) return null;
+  const head = m[1];
+  const dot = head.lastIndexOf(".");
+  if (dot < 0) return { method: head };
+  return { qualifier: head.slice(0, dot), method: head.slice(dot + 1) };
+}
+function javaMethodBodyReturnLooksLikeShellArgv(methodStart, methodEnd, sourceLines) {
+  for (let l = methodStart; l <= methodEnd; l++) {
+    const line = (sourceLines[l - 1] ?? "").trim();
+    const ret = /\breturn\s+(.+?)\s*;/.exec(line);
+    if (!ret) continue;
+    if (callArgLooksLikeShellArgv(ret[1].trim(), "new ProcessBuilder(")) return true;
+  }
+  return false;
+}
+function javaResolveCalleeMethodLines(methodName, qualifier, refLine, types, sourceLines, ctx) {
+  const enclosing = types.find((t) => refLine >= t.start_line && refLine <= t.end_line);
+  const typeName = qualifier ? qualifier.includes(".") ? qualifier.split(".").pop() : qualifier : enclosing?.name;
+  if (!typeName) return void 0;
+  const tryType = (t, lines) => {
+    const mm = t.methods.find((m) => m.name === methodName);
+    if (!mm) return void 0;
+    return { start: mm.start_line, end: mm.end_line, lines };
+  };
+  if (ctx?.projectGraph && ctx.sourceLinesByFile) {
+    for (const fp of ctx.projectGraph.filePaths) {
+      const ir = ctx.projectGraph.getIR(fp);
+      if (!ir) continue;
+      const t = ir.types.find((tt) => tt.name === typeName);
+      if (!t) continue;
+      const lines = ctx.sourceLinesByFile.get(fp);
+      if (!lines) continue;
+      const hit = tryType(t, lines);
+      if (hit) return hit;
+    }
+  }
+  const local = types.find((t) => t.name === typeName);
+  if (local) return tryType(local, sourceLines);
+  return void 0;
+}
+function javaExpressionLooksLikeShellArgv(expr, refLine, types, sourceLines, ctx) {
+  if (callArgLooksLikeShellArgv(expr, "new ProcessBuilder(")) return true;
+  const parsed = parseSimpleJavaCall(expr);
+  if (!parsed) return false;
+  const body2 = javaResolveCalleeMethodLines(
+    parsed.method,
+    parsed.qualifier,
+    refLine,
+    types,
+    sourceLines,
+    ctx
+  );
+  if (!body2) return false;
+  return javaMethodBodyReturnLooksLikeShellArgv(body2.start, body2.end, body2.lines);
+}
+function javaFieldShellArgvWrittenBeforeLine(fieldName, beforeLine, methodStart, methodEnd, sourceLines, types, ctx) {
+  const cap = fieldName.charAt(0).toUpperCase() + fieldName.slice(1);
+  const beanSetter = new RegExp(`\\bset${escapeReSf(cap)}\\s*\\((.+)\\)\\s*;?\\s*$`);
+  const fieldAssign = new RegExp(`^\\s*(?:this\\.)?${escapeReSf(fieldName)}\\s*=\\s*(.+?)\\s*;\\s*(?://.*)?$`);
+  for (let l = methodStart; l < beforeLine && l <= methodEnd; l++) {
+    const line = (sourceLines[l - 1] ?? "").trim();
+    const sm = beanSetter.exec(line);
+    if (sm && javaExpressionLooksLikeShellArgv(sm[1].trim(), l, types, sourceLines, ctx)) {
+      return true;
+    }
+    const fm = fieldAssign.exec(line);
+    if (fm && callArgLooksLikeShellArgv(fm[1].trim(), "new ProcessBuilder(")) return true;
+  }
+  return false;
+}
+function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, calls, sourceLines) {
   if (!methodName) return false;
   for (const t of types) {
     const m = t.methods.find((mm) => mm.name === methodName && sinkLine >= mm.start_line && sinkLine <= mm.end_line);
     if (!m) continue;
     const pos = m.parameters.findIndex((p) => p.name === paramName);
-    if (pos < 0) return false;
+    if (pos < 0) {
+      const isField = t.fields?.some((f) => f.name === paramName);
+      if (!isField) return false;
+      return calls.some((c) => {
+        if (c.method_name !== methodName) return false;
+        if (c.receiver != null && c.receiver !== "this") return false;
+        if (c.location.line < t.start_line || c.location.line > t.end_line) return false;
+        if (c.arguments.length !== m.parameters.length) return false;
+        const callerMethod = t.methods.find(
+          (mm) => c.location.line >= mm.start_line && c.location.line <= mm.end_line
+        );
+        if (!callerMethod) return false;
+        return javaFieldShellArgvWrittenBeforeLine(
+          paramName,
+          c.location.line,
+          callerMethod.start_line,
+          callerMethod.end_line,
+          sourceLines,
+          types
+        );
+      });
+    }
     return calls.some((c) => {
       if (c.method_name !== methodName) return false;
       if (c.receiver != null && c.receiver !== "this") return false;
@@ -40947,8 +43074,30 @@ function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, c
       if (c.arguments.length !== m.parameters.length) return false;
       const shadowed = types.some((u) => u !== t && u.start_line >= t.start_line && u.end_line <= t.end_line && (u.start_line > t.start_line || u.end_line < t.end_line) && c.location.line >= u.start_line && c.location.line <= u.end_line && u.methods.some((um) => um.name === methodName && um.parameters.length === c.arguments.length));
       if (shadowed) return false;
-      const expr = c.arguments[pos]?.expression;
-      return typeof expr === "string" && argvFirstLiteralIsShell(`new ProcessBuilder(${expr}`);
+      const expr = (c.arguments[pos]?.expression ?? "").trim();
+      if (!expr) return false;
+      if (javaExpressionLooksLikeShellArgv(expr, c.location.line, types, sourceLines)) {
+        return true;
+      }
+      const argVar = c.arguments[pos]?.variable;
+      if (argVar && expr === argVar && !/[.(]/.test(expr)) {
+        const callerMethod = t.methods.find(
+          (mm) => c.location.line >= mm.start_line && c.location.line <= mm.end_line
+        );
+        if (callerMethod) {
+          const rhs = javaLocalInitRhsBeforeLine(
+            argVar,
+            c.location.line,
+            callerMethod.start_line,
+            callerMethod.end_line,
+            sourceLines
+          );
+          if (rhs && javaExpressionLooksLikeShellArgv(rhs, c.location.line, types, sourceLines)) {
+            return true;
+          }
+        }
+      }
+      return false;
     });
   }
   return false;
@@ -41003,12 +43152,42 @@ var FETCH_GLOBAL_RECEIVER_RE = /(?:^|[^.\w])(?:window|globalThis|self|global)\s*
 var FETCH_MEMBER_RECEIVER_RE = /[\w$)\]]\s*\.\s*fetch\s*\(/;
 var NOSQL_ARRAY_METHODS = /* @__PURE__ */ new Set(["find", "filter", "some", "every", "findIndex", "findLast"]);
 var FUNCTION_FIRST_ARG_RE = /\.\s*(?:find|filter|some|every|findIndex|findLast)\s*\(\s*(?:async\s+)?(?:function\b|(?:\([^()]*\)|[A-Za-z_$][\w$]*)\s*=>)/;
+var NAMED_ARRAY_PREDICATE_RE = /([A-Za-z_$][\w$]*)\s*\.\s*(find|filter|some|every|findIndex|findLast)\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+function isDeclaredFunctionName(name2, lines) {
+  const n = name2.replace(/[$]/g, "\\$");
+  const decls = [
+    new RegExp(`\\bfunction\\s+${n}\\s*[(<]`),
+    new RegExp(`\\b(?:const|let|var)\\s+${n}\\s*(?::[^=]*)?=\\s*(?:async\\s+)?(?:function\\b|\\(|[A-Za-z_$][\\w$]*\\s*=>)`)
+  ];
+  return lines.some((l) => decls.some((re) => re.test(l)));
+}
+function isDeclaredArrayName(name2, lines) {
+  const n = name2.replace(/[$]/g, "\\$");
+  const re = new RegExp(
+    `\\b${n}\\s*(?:\\??\\s*:\\s*(?:readonly\\s+)?(?:[\\w$.<>,\\s]+\\[\\]|(?:Readonly)?Array\\s*<)|(?::[^=;]*)?=\\s*(?:\\[|new\\s+Array\\b|Array\\.(?:from|of)\\b))`
+  );
+  return lines.some((l) => re.test(l));
+}
 var ORM_BUILDER_KEY_RE = /[{,]\s*(?:where|select|populate|include|orderBy|relations|attributes)\s*:/;
 var BROWSER_COMPONENT_EXT_RE = /\.(?:jsx|tsx|vue|svelte)$/;
 var CLIENT_SIGNAL_RE = /["']use client["']|\buse(?:State|Effect|Ref|Callback|Memo|Context|Reducer|LayoutEffect)\s*\(|\b(?:window|document|localStorage|sessionStorage|navigator)\s*\.|\son(?:Click|Change|Submit|Input|KeyDown|KeyUp|MouseOver|Focus|Blur)\s*=/;
 var SERVER_SIGNAL_RE = /["']use server["']|\b(?:getServerSideProps|getStaticProps|getStaticPaths)\b|from\s+["']next\/server["']|\bNext(?:Api)?(?:Request|Response)\b|from\s+["'](?:node:)?(?:fs|child_process|http|https|net|dns|dgram)["']|\bexport\s+(?:default\s+)?(?:async\s+)?function\s+handler\s*\(/;
 var FIXED_HOST_TEMPLATE_RE = /`https?:\/\/[^/${}\s`]+[/`]/;
 var BASH_FIXED_HOST_URL_RE = /^(?:https?|ftp):\/\/[A-Za-z0-9.-]+(?::\d+)?\//;
+var RUST_FIXED_HOST_FORMAT_RE = /format!\(\s*"https?:\/\/[^"{}]+\/\{\}"/;
+function rustSsrfRequestUsesFixedHostFormat(code, sinkLine) {
+  const lines = code.split("\n");
+  const sinkText = lines[sinkLine - 1] ?? "";
+  const argMatch = sinkText.match(/(?:reqwest::)?get\s*\(\s*&?(\w+)/);
+  if (!argMatch) return false;
+  const varName = argMatch[1];
+  const assignRe = new RegExp(`\\blet\\s+${escapeRegex2(varName)}\\s*=\\s*format!`);
+  for (let i2 = sinkLine - 2; i2 >= Math.max(0, sinkLine - 20); i2--) {
+    const line = lines[i2] ?? "";
+    if (assignRe.test(line) && RUST_FIXED_HOST_FORMAT_RE.test(line)) return true;
+  }
+  return false;
+}
 function literalEndsInitializer(code, end) {
   let i2 = end;
   let crossedNewline = false;
@@ -41180,7 +43359,9 @@ function isUnwrittenLocalMapKeyRead(code, source) {
   if (!read) return false;
   const [, recv, key] = read;
   const ctorRe = new RegExp(
-    `\\b${recv}\\s*=\\s*new\\s+(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`
+    // `new HashMap<>()` or the qualified `new java.util.HashMap<>()` (OWASP
+    // BenchmarkJava writes the qualified form throughout).
+    `\\b${recv}\\s*=\\s*new\\s+(?:java\\.util\\.(?:concurrent\\.)?)?(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`
   );
   if (!lines.some((l) => ctorRe.test(l))) return false;
   const escapeRe2 = new RegExp(`\\w\\s*\\([^)]*(?<![\\w.])${recv}(?![\\w.])[^)]*\\)`);
@@ -41190,26 +43371,46 @@ function isUnwrittenLocalMapKeyRead(code, source) {
     if (escapeRe2.test(stripped)) return false;
   }
   const putRe = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}"`);
-  if (lines.some((l) => putRe.test(l))) return isLiteralOnlyLocalMap(lines, recv);
+  if (lines.some((l) => putRe.test(l))) return isLiteralOnlyLocalMapKey(lines, recv, key);
   return true;
 }
-function isLiteralOnlyLocalMap(lines, recv) {
-  const anyPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(`, "g");
-  const literalPut = new RegExp(
-    `\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*(?:"(?:[^"\\\\]|\\\\.)*"|[A-Za-z_][\\w.]*)\\s*,\\s*"(?:[^"\\\\]|\\\\.)*"\\s*\\)`,
-    "g"
-  );
+function isLiteralOnlyLocalMapKey(lines, recv, key) {
+  const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const otherMutator = new RegExp(
     `\\b${recv}\\s*\\.\\s*(?:putAll|putIfAbsent|compute|computeIfAbsent|computeIfPresent|merge|replace|replaceAll|entrySet|values)\\s*\\(`
   );
-  let puts = 0;
-  let literalPuts = 0;
+  if (lines.some((l) => otherMutator.test(l))) return false;
+  const keyPut = new RegExp(
+    `\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${escapedKey}"\\s*,\\s*"(?:[^"\\\\]|\\\\.)*"\\s*\\)`
+  );
+  const anyKeyPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${escapedKey}"`);
+  let putsForKey = 0;
+  let literalPutsForKey = 0;
   for (const l of lines) {
-    if (otherMutator.test(l)) return false;
-    puts += (l.match(anyPut) ?? []).length;
-    literalPuts += (l.match(literalPut) ?? []).length;
+    putsForKey += (l.match(anyKeyPut) ?? []).length;
+    literalPutsForKey += (l.match(keyPut) ?? []).length;
   }
-  return puts > 0 && puts === literalPuts;
+  return putsForKey > 0 && putsForKey === literalPutsForKey;
+}
+function isJsDisguisedCacheDbInputRead(code, source) {
+  if (source.type !== "db_input") return false;
+  const loc = source.location ?? "";
+  if (!/\.cache\.get\s*\(/i.test(loc) && !/\bcache\.get\s*\(/i.test(loc)) return false;
+  const lines = code.split("\n");
+  const lineText = lines[source.line - 1] ?? "";
+  if (/\w+\.cache\.get\s*\(/.test(lineText)) return true;
+  const read = /\b([A-Za-z_]\w*)\s*\.\s*get\s*\(/.exec(lineText);
+  if (!read) return false;
+  const recv = read[1];
+  if (recv !== "cache") return false;
+  const mapCtor = new RegExp(
+    `\\b${recv}\\s*=\\s*new\\s+(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`
+  );
+  if (lines.some((l) => mapCtor.test(l))) return true;
+  const redisClient = new RegExp(
+    `\\b${recv}\\s*=\\s*(?:await\\s+)?(?:redis\\.)?createClient\\s*\\(`
+  );
+  return !lines.some((l) => redisClient.test(l));
 }
 function csharpContentServesHtml(call) {
   if (call.receiver !== null && call.receiver !== "this" && call.receiver !== "base") return false;
@@ -41217,8 +43418,8 @@ function csharpContentServesHtml(call) {
   if (contentType === void 0) return true;
   const literal = /^@?"([^"]*)"$/.exec(contentType);
   if (literal) return /^\s*(?:text\/html|text\/xml|application\/xml|[\w.-]+\/[\w.-]+\+xml)\b/i.test(literal[1]);
-  const named = /^(?:System\s*\.\s*Net\s*\.\s*Mime\s*\.\s*)?MediaTypeNames\s*\.\s*(Text|Application)\s*\.\s*(\w+)$/.exec(contentType);
-  if (named) return named[2] === "Html" || named[2] === "Xml";
+  const named2 = /^(?:System\s*\.\s*Net\s*\.\s*Mime\s*\.\s*)?MediaTypeNames\s*\.\s*(Text|Application)\s*\.\s*(\w+)$/.exec(contentType);
+  if (named2) return named2[2] === "Html" || named2[2] === "Xml";
   return true;
 }
 function csharpContentCallInheritsHelper(call, types, sourceLines) {
@@ -41385,7 +43586,7 @@ function findEnclosingMethodFromIr(types, sinkLine) {
   return null;
 }
 function splitJavaConcatTokens(rhs) {
-  const tokens = [];
+  const tokens2 = [];
   let cur = "";
   let depth = 0;
   let inString = false;
@@ -41422,7 +43623,7 @@ function splitJavaConcatTokens(rhs) {
       continue;
     }
     if (ch === "+" && depth === 0) {
-      tokens.push(cur.trim());
+      tokens2.push(cur.trim());
       cur = "";
       i2++;
       continue;
@@ -41430,8 +43631,8 @@ function splitJavaConcatTokens(rhs) {
     cur += ch;
     i2++;
   }
-  if (cur.trim()) tokens.push(cur.trim());
-  return tokens;
+  if (cur.trim()) tokens2.push(cur.trim());
+  return tokens2;
 }
 function isImplicitlyAnchoredAllowlistRegex(re) {
   if (re === "") return false;
@@ -41536,7 +43737,7 @@ var SinkFilterPass = class {
     const executableSources = ctx.code && ctx.language ? mergedSources.filter(
       (s) => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language)
     ) : mergedSources;
-    const sources = ctx.code ? executableSources.filter((s) => !isUnwrittenLocalMapKeyRead(ctx.code, s)) : executableSources;
+    const sources = ctx.code ? executableSources.filter((s) => !isUnwrittenLocalMapKeyRead(ctx.code, s)).filter((s) => !isJsDisguisedCacheDbInputRead(ctx.code, s)) : executableSources;
     const sinks = [...taintMatcher.sinks];
     for (const s of langSources.additionalSinks) {
       const springReturn = s.type === "xss" && typeof s.location === "string" && s.location.startsWith("Spring handler returns HTML");
@@ -41844,7 +44045,7 @@ var SinkFilterPass = class {
         const varName = arg0.variable ?? "";
         if (varName !== "" && argExpr === varName && !/[(.]/.test(argExpr)) {
           const t = resolveIdentifierType(varName, ctorCall.in_method, irTypes);
-          if (isArgvContainerType(t) && !sameFileCallerPassesShellArgv(varName, ctorCall.in_method, ctorCall.location.line, irTypes, irCalls)) {
+          if (isArgvContainerType(t) && !sameFileCallerPassesShellArgv(varName, ctorCall.in_method, ctorCall.location.line, irTypes, irCalls, sourceLines)) {
             return false;
           }
         }
@@ -42027,11 +44228,11 @@ var SinkFilterPass = class {
           rhs = sqlVar;
         }
         if (!rhs) return true;
-        const tokens = splitJavaConcatTokens(rhs);
-        if (tokens.length < 2) return true;
+        const tokens2 = splitJavaConcatTokens(rhs);
+        if (tokens2.length < 2) return true;
         let hasPlaceholder = false;
         const methodCallNames = [];
-        for (const tk of tokens) {
+        for (const tk of tokens2) {
           if (/^"(?:[^"\\]|\\.)*"$/.test(tk)) {
             if (tk.includes("?")) hasPlaceholder = true;
             continue;
@@ -42094,7 +44295,15 @@ var SinkFilterPass = class {
         if (sink.type !== "nosql_injection") return true;
         if (!NOSQL_ARRAY_METHODS.has(sink.method ?? "")) return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        return !FUNCTION_FIRST_ARG_RE.test(sinkLineText);
+        if (FUNCTION_FIRST_ARG_RE.test(sinkLineText)) return false;
+        const named2 = NAMED_ARRAY_PREDICATE_RE.exec(sinkLineText);
+        if (named2) {
+          const [, receiver, method, arg] = named2;
+          if (NOSQL_ARRAY_METHODS.has(method) && (isDeclaredFunctionName(arg, sourceLines) || isDeclaredArrayName(receiver, sourceLines))) {
+            return false;
+          }
+        }
+        return true;
       });
     }
     if (["javascript", "typescript"].includes(language)) {
@@ -42211,6 +44420,12 @@ var SinkFilterPass = class {
         return bodyCalls.length === 0 || !bodyCalls.every(rustBodyDeclaresNonHtmlType);
       });
     }
+    if (language === "rust") {
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "ssrf") return true;
+        return !rustSsrfRequestUsesFixedHostFormat(ctx.code, sink.line);
+      });
+    }
     if (language === "bash") {
       const sourceLines = ctx.code.split("\n");
       filtered = filtered.filter((sink) => {
@@ -42733,7 +44948,9 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
   return sinks.filter((sink) => {
     const callsAtSink = callsByLine.get(sink.line) ?? [];
     const isInSynchronizedBlock = synchronizedLines?.has(sink.line) ?? false;
-    const relevantCalls = sink.method ? callsAtSink.filter((c) => c.method_name === sink.method) : callsAtSink;
+    const relevantCalls = sink.method ? callsAtSink.filter(
+      (c) => c.method_name === sink.method && (sink.callColumn === void 0 || c.location.column === sink.callColumn)
+    ) : callsAtSink;
     const trustArgPositions = language !== "bash" && language !== "shell";
     for (const call of relevantCalls) {
       let allArgsAreClean = true;
@@ -43498,19 +45715,59 @@ function rustAttributesAbove(lines, startLine) {
       continue;
     }
     if (t === "" || t.startsWith("//")) continue;
+    if (out2.length > 0) break;
     break;
   }
   return out2;
 }
+function isModuleLevelFunction(method, lines) {
+  const first = lines[method.start_line - 1] ?? "";
+  return !/^\s/.test(first);
+}
+function jsTsExportBinding(exportName, lines) {
+  const esc = exportName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const text = lines.join("\n");
+  const first = lines.find((l) => /^\s*(?:export|function|const|async)/.test(l)) ?? "";
+  if (/^export\s+(?:default\s+)?(?:async\s+)?(?:function\b|(?:const|let|var)\s+)/.test(first.trimStart()) && new RegExp(`\\b${esc}\\b`).test(first)) {
+    return true;
+  }
+  if (new RegExp(`(?:^|\\n)\\s*export\\s*\\{[^}]*\\b${esc}\\b`).test(text)) return true;
+  if (new RegExp(`(?:^|[^\\w$.])(?:module\\s*\\.\\s*)?exports\\s*\\.\\s*${esc}\\s*=`).test(text)) return true;
+  if (new RegExp(`module\\s*\\.\\s*exports\\s*=\\s*\\{[^}]*\\b${esc}\\b`).test(text)) return true;
+  return false;
+}
+var CHANNEL_EXPORT_HANDLER_NAMES = /* @__PURE__ */ new Set([
+  "handle",
+  "getUser",
+  "onMessage",
+  "onWebhook",
+  "resolveUser",
+  "sse"
+]);
+var CHANNEL_HANDLER_PARAM = /^(event|req|request|ctx|context|message|payload|topic|id|user|_|args|info)$/;
+function hasChannelHandlerParamSignature(method) {
+  if (method.parameters.length === 0) return false;
+  return method.parameters.some((p) => CHANNEL_HANDLER_PARAM.test(p.name));
+}
+function isChannelExportedHandler(method, language, lines) {
+  if (language !== "javascript" && language !== "typescript") return false;
+  if (!isModuleLevelFunction(method, lines)) return false;
+  if (!CHANNEL_EXPORT_HANDLER_NAMES.has(method.name)) return false;
+  if (!hasChannelHandlerParamSignature(method)) return false;
+  return jsTsExportBinding(method.name, lines);
+}
 function isLambdaEntryPoint(method, language, lines) {
   const names = method.parameters.map((p) => p.name);
   const first = lines[method.start_line - 1] ?? "";
-  if (/^\s/.test(first)) return false;
+  if (!isModuleLevelFunction(method, lines)) return false;
   if (language === "python") {
     return method.name === "lambda_handler" && names.length === 2 && names[0] === "event" && names[1] === "context";
   }
   if (language !== "javascript" && language !== "typescript") return false;
   if (method.name !== "handler") return false;
+  if (names.length === 1 && names[0] === "event") {
+    return jsTsExportBinding("handler", lines) || /^export\s+(?:default\s+)?(?:async\s+)?(?:function\b|(?:const|let|var)\s+handler\b)/.test(first);
+  }
   if (names.length < 2 || names.length > 3 || names[0] !== "event" || names[1] !== "context") return false;
   if (names.length === 3 && names[2] !== "callback") return false;
   if (/^export\s+(?:default\s+)?(?:async\s+)?(?:function\b|(?:const|let|var)\s+handler\b)/.test(first)) return true;
@@ -43520,6 +45777,7 @@ function isLambdaEntryPoint(method, language, lines) {
 function isFrameworkHandler(method, language, lines) {
   if (method.annotations.some((a) => ROUTE_ANNOTATION.test(a))) return true;
   if (isLambdaEntryPoint(method, language, lines)) return true;
+  if (isChannelExportedHandler(method, language, lines)) return true;
   if (language === "rust") {
     if (rustAttributesAbove(lines, method.start_line).some((a) => RUST_ROUTE_ATTR.test(a))) return true;
     if (method.return_type && RUST_HANDLER_RETURN.test(method.return_type)) return true;
@@ -43535,6 +45793,11 @@ function isReactHtmlComponent(m, f, lines) {
   const sig = lines[m.start_line - 1] ?? "";
   return /\bfunction\s+[A-Z][A-Za-z0-9]*\s*\(\s*\{/.test(sig);
 }
+function isRustDieselSqlParamFlow(f, lines) {
+  if (f.source_type !== "interprocedural_param" || f.sink_type !== "sql_injection") return false;
+  const sinkLine = lines[f.sink_line - 1] ?? "";
+  return /\b(?:sql_query|raw_sql)\s*\(/.test(sinkLine);
+}
 function isPythonYamlLoadParamDeser(f, lines) {
   if (f.source_type !== "interprocedural_param" || f.sink_type !== "deserialization") return false;
   const head = f.path[0]?.variable;
@@ -43664,8 +45927,8 @@ var ParamSourceFlowGatePass = class {
       const viaReceiver = !isCtor && !!owner && owner.name !== "<module>";
       const feeds = (pos) => fed.params.has(`${viaReceiver ? "m" : "f"}:${callee}:${pos}`);
       const head = f.path[0]?.variable;
-      const named = m.parameters.findIndex((p) => p.name === head);
-      if (named >= 0) return feeds(named);
+      const named2 = m.parameters.findIndex((p) => p.name === head);
+      if (named2 >= 0) return feeds(named2);
       for (const s of sources) {
         if (s.line !== f.source_line || s.type !== "interprocedural_param") continue;
         if (FIELD_CARRIED_SOURCE.test(s.location ?? "")) {
@@ -43683,7 +45946,7 @@ var ParamSourceFlowGatePass = class {
       let keep = true;
       if (f.source_type === "interprocedural_param" && !realSourceLines.has(f.source_line)) {
         const m = enclosingMethod(methods, f.source_line);
-        keep = m !== void 0 && (isHandler(m) || fedByRealSource(f, m) || isReactHtmlComponent(m, f, lines) || ctx.language === "python" && isPythonYamlLoadParamDeser(f, lines));
+        keep = m !== void 0 && (isHandler(m) || fedByRealSource(f, m) || isReactHtmlComponent(m, f, lines) || ctx.language === "python" && isPythonYamlLoadParamDeser(f, lines) || ctx.language === "rust" && isRustDieselSqlParamFlow(f, lines));
       }
       if (keep) flows[w++] = f;
       else {
@@ -44359,6 +46622,32 @@ function indexJavaLocalAssignments(code) {
   }
   return index;
 }
+function goCalleeBaseName(callee) {
+  const dot = callee.lastIndexOf(".");
+  return dot === -1 ? callee : callee.slice(dot + 1);
+}
+function goConstantHelperCalleeOnLine(line) {
+  const m = line.match(/:=\s*([\w.]+)\s*\(/) ?? line.match(/\bvar\s+\w+\s*=\s*([\w.]+)\s*\(/);
+  if (!m) return null;
+  return goCalleeBaseName(m[1]);
+}
+function goConstantHelperCalleeFromLines(lines, lineNumber) {
+  const direct = goConstantHelperCalleeOnLine(lines[lineNumber - 1] ?? "");
+  if (direct) return direct;
+  const cur = lines[lineNumber - 1] ?? "";
+  const partial = cur.match(/:=\s*([\w.]+)\s*$/) ?? cur.match(/\bvar\s+\w+\s*=\s*([\w.]+)\s*$/);
+  if (partial) {
+    const next = (lines[lineNumber] ?? "").trimStart();
+    if (next.startsWith("(")) return goCalleeBaseName(partial[1]);
+  }
+  if (!cur.includes(":=") && !/\bvar\s+\w+\s*=/.test(cur)) return null;
+  if (cur.includes("(")) return null;
+  for (let i2 = lineNumber + 1; i2 <= Math.min(lines.length, lineNumber + 4); i2++) {
+    const m = (lines[i2 - 1] ?? "").match(/^\s*([\w.]+)\s*\(/);
+    if (m) return goCalleeBaseName(m[1]);
+  }
+  return null;
+}
 function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
   const lines = typeof code === "string" ? code.split("\n") : [];
   const selfReassign = /* @__PURE__ */ new Map();
@@ -44454,8 +46743,8 @@ function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers
     if (d.line === sourceLine && sources.some((s) => s.line === sourceLine && !CONTAINER_READ_SOURCES.has(s.type))) {
       if (step.line === sinkLine && !constProp.tainted.has(fpLookup)) {
         for (let ln = sourceLine; ln <= sinkLine; ln++) {
-          const calleeMatch = (lines[ln - 1] ?? "").match(/:=\s*(\w+)\s*\(/);
-          if (calleeMatch && constProp.constantReturningMethods?.has(calleeMatch[1])) {
+          const callee = goConstantHelperCalleeFromLines(lines, ln);
+          if (callee && constProp.constantReturningMethods?.has(callee)) {
             return true;
           }
         }
@@ -44658,7 +46947,17 @@ var TaintPropagationPass = class {
       if (isFP) continue;
       pushIfNew(f);
     }
-    const paramFlows = detectParameterSinkFlows(types, calls, sources, sinks, constProp.unreachableLines, constProp.tainted, ctx.code) ?? [];
+    const paramFlows = detectParameterSinkFlows(
+      types,
+      calls,
+      sources,
+      sinks,
+      constProp.unreachableLines,
+      constProp.tainted,
+      ctx.code,
+      ctx.language,
+      graph.ir.meta.file
+    ) ?? [];
     for (const f of paramFlows) {
       pushIfNew(f);
     }
@@ -44733,6 +47032,22 @@ var TaintPropagationPass = class {
       if (sanitizedNames.has(sourceVar) && coversFlow(sourceVar)) return false;
       return true;
     });
+    if (ctx.language === "csharp") {
+      finalFlows = finalFlows.filter(
+        (f) => !shouldGateCSharpPatPermsLibraryParamFlow(
+          f,
+          sources,
+          sinks,
+          types,
+          {
+            language: ctx.language,
+            types,
+            filePath: graph.ir.meta.file,
+            calls
+          }
+        )
+      );
+    }
     if (sanitizers && sanitizers.length > 0) {
       const sanitizersByLine = /* @__PURE__ */ new Map();
       for (const san of sanitizers) {
@@ -45125,7 +47440,7 @@ function detectJsModuleScopeFlows(code, sources, sinks, unreachableLines) {
   for (const line of lines) {
     const stripped = line.replace(/\s+$/, "");
     if (!stripped || /^[ \t]/.test(line)) continue;
-    const m = stripped.match(/^(?:let|var|const)\s+([A-Za-z_$][\w$]*)\b/);
+    const m = stripped.match(/^(?:export\s+)?(?:let|var|const)\s+([A-Za-z_$][\w$]*)\b/);
     if (m) moduleVars.add(m[1]);
   }
   if (moduleVars.size === 0) return flows;
@@ -45141,7 +47456,9 @@ function detectJsModuleScopeFlows(code, sources, sinks, unreachableLines) {
     const line = lines[i2];
     if (unreachableLines.has(i2 + 1)) continue;
     for (const lhs of moduleVars) {
-      const declRe = new RegExp(`\\b(?:let|const|var)\\s+${lhs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
+      const declRe = new RegExp(
+        `\\b(?:export\\s+)?(?:let|const|var)\\s+${lhs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`
+      );
       if (declRe.test(line)) continue;
       const m = line.match(
         new RegExp(`\\b${lhs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=\\s*([^;]+)`)
@@ -45263,6 +47580,16 @@ function isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isField
   }
   return true;
 }
+function mapGetLiteralKeyFromExpr(expr) {
+  const m = expr.match(/\b([A-Za-z_]\w*)\s*\.\s*get\s*\(\s*"([^"]*)"\s*\)/);
+  return m ? { map: m[1], key: m[2] } : null;
+}
+function isMapLiteralKeyTainted(constProp, mapName, key, inMethod) {
+  const scoped = inMethod ? `${inMethod}:${mapName}` : mapName;
+  const keys = constProp.taintedCollections.get(mapName) ?? constProp.taintedCollections.get(scoped);
+  if (!keys || keys.size === 0) return false;
+  return keys.has(key) || keys.has("*");
+}
 function detectCollectionFlows(calls, sources, sinks, constProp, code, types, graph) {
   const taintedVars = constProp.tainted;
   const unreachableLines = constProp.unreachableLines;
@@ -45305,7 +47632,23 @@ function detectCollectionFlows(calls, sources, sinks, constProp, code, types, gr
           );
           const bareFieldRead = fieldNames.has(varName) && expr === varName && !methodHasLocalDecl(code, call.in_method, varName, call.location.line);
           const isFieldUse = explicitField || bareFieldRead;
-          if (isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isFieldUse)) {
+          const mapKeyRead = mapGetLiteralKeyFromExpr(expr);
+          let argTainted = isTaintedInMethod(
+            taintedVars,
+            varName,
+            scopedName,
+            fieldNames,
+            isFieldUse
+          );
+          if (mapKeyRead && mapKeyRead.map === varName) {
+            argTainted = isMapLiteralKeyTainted(
+              constProp,
+              varName,
+              mapKeyRead.key,
+              call.in_method
+            );
+          }
+          if (argTainted) {
             const source = pickScopedSource(sources, sink.line, call.in_method ?? null, types, varName);
             if (source) {
               if (source.variable && source.variable !== varName && source.in_method && call.in_method && source.in_method !== call.in_method) {
@@ -45340,12 +47683,23 @@ function detectCollectionFlows(calls, sources, sinks, constProp, code, types, gr
             { method: "peek", re: /(\w+)\.peek\(/ },
             { method: "toArray", re: /(\w+)\.toArray\(/ }
           ];
-          for (const { re } of collectionPatterns) {
+          for (const { method, re } of collectionPatterns) {
             const match = expr.match(re);
             if (match) {
               const collectionVar = match[1];
               const scopedCollection = call.in_method ? `${call.in_method}:${collectionVar}` : collectionVar;
-              if (taintedVars.has(collectionVar) || taintedVars.has(scopedCollection)) {
+              const mapKey = method === "get" ? mapGetLiteralKeyFromExpr(expr) : null;
+              let collectionTainted = taintedVars.has(collectionVar) || taintedVars.has(scopedCollection);
+              if (mapKey && mapKey.map === collectionVar) {
+                collectionTainted = isMapLiteralKeyTainted(
+                  constProp,
+                  collectionVar,
+                  mapKey.key,
+                  call.in_method
+                );
+              }
+              if (!collectionTainted) continue;
+              {
                 const source = pickScopedSource(sources, sink.line, call.in_method ?? null, types, collectionVar);
                 if (source) {
                   if (source.variable && source.variable !== collectionVar && source.in_method && call.in_method && source.in_method !== call.in_method) {
@@ -45422,6 +47776,39 @@ function detectArrayElementFlows(calls, sources, sinks, taintedArrayElements, un
   }
   return flows;
 }
+function csharpPatPermsDirectParamSink(sink, paramVar) {
+  const method = (sink.method ?? "").replace(/^.*\./, "");
+  if (method !== "FileStream") return false;
+  const code = sink.code ?? "";
+  if (!code) return true;
+  const escaped = paramVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\bFileStream\\s*\\(\\s*${escaped}\\b`).test(code);
+}
+function shouldGateCSharpPatPermsLibraryParamFlow(flow, sources, sinks, types, ctx) {
+  if (flow.source_type !== "interprocedural_param" || flow.sink_type !== "path_traversal") {
+    return false;
+  }
+  const srcVar = flow.path?.[0]?.variable;
+  const sinkVar = flow.path?.[flow.path.length - 1]?.variable;
+  if (!srcVar || srcVar !== sinkVar) return false;
+  const sink = sinks.find(
+    (s) => s.line === flow.sink_line && s.type === "path_traversal"
+  );
+  if (!sink || !csharpPatPermsDirectParamSink(sink, srcVar)) return false;
+  const src = sources.find(
+    (s) => s.line === flow.source_line && s.type === "interprocedural_param"
+  );
+  const methodName = src?.in_method;
+  if (!methodName) return false;
+  const enclosingType = types.find((t) => t.methods.some((m) => m.name === methodName));
+  const enclosingMethod2 = enclosingType?.methods.find((m) => m.name === methodName);
+  return shouldGateInterproceduralParam(
+    flow.source_type,
+    enclosingMethod2,
+    enclosingType,
+    ctx
+  );
+}
 function compoundArgParamNames(expression, paramNames) {
   const stripped = expression.replace(/(['"`])(?:\\.|(?!\1).)*\1/g, (m) => " ".repeat(m.length));
   const matched = [];
@@ -45435,7 +47822,7 @@ function compoundArgParamNames(expression, paramNames) {
   }
   return matched;
 }
-function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines, tainted, code) {
+function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines, tainted, code, language, filePath) {
   const flows = [];
   const paramSourcesByMethod = /* @__PURE__ */ new Map();
   for (const source of sources) {
@@ -45476,6 +47863,20 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
         for (const varName of varNames) {
           const paramSource = methodParamSources.get(varName);
           if (paramSource) {
+            if (language === "csharp" && paramSource.type === "interprocedural_param" && sink.type === "path_traversal" && csharpPatPermsDirectParamSink(sink, varName)) {
+              const enclosingType = types.find(
+                (t) => t.methods.some((m) => m.name === methodName)
+              );
+              const enclosingMethod2 = enclosingType?.methods.find((m) => m.name === methodName);
+              if (shouldGateInterproceduralParam(
+                paramSource.type,
+                enclosingMethod2,
+                enclosingType,
+                { language, types, filePath, calls }
+              )) {
+                continue;
+              }
+            }
             const exists = flows.some((f) => f.source_line === paramSource.line && f.sink_line === sink.line && f.sink_type === sink.type);
             if (!exists) {
               if (typeof code === "string" && isReassignedToLiteralBetween(code, varName, paramSource.line, sink.line, unreachableLines)) {
@@ -46470,9 +48871,18 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         if (!prev || s.line < prev.line) realSourceByVar.set(s.variable, s);
       }
       for (const [varName, derivedLine] of derived) {
-        if (!varName || existingVars.has(varName)) continue;
+        if (!varName) continue;
         const owner = methodAt(derivedLine);
         const fieldAlias = isDeclaredField(derivedLine, varName);
+        if (existingVars.has(varName)) {
+          if (!fieldAlias) continue;
+          const stubIdx = sourcesWithVar.findIndex(
+            (s) => s.variable === varName && s.type === "interprocedural_param"
+          );
+          if (stubIdx < 0) continue;
+          sourcesWithVar.splice(stubIdx, 1);
+          existingVars.delete(varName);
+        }
         let scopedAnchor = anchor;
         if (owner) {
           let best;
@@ -51831,10 +54241,28 @@ var InsecureCookiePass = class {
    * unassigned `new Cookie(...)` only looks at that statement, so another
    * cookie's setter cannot cover it.
    */
+  /** Cookie variable assigned to this `new Cookie(...)` call site (per-cookie, #595). */
+  javaCookieVarName(code, call) {
+    const lines = code.split("\n");
+    const idx = (call.location.line ?? 1) - 1;
+    const line = lines[idx] ?? "";
+    const sameLine = /\b([A-Za-z_]\w*)\s*=\s*new\s+(?:[\w.]+\.)?Cookie\b/.exec(line);
+    if (sameLine?.[1]) return sameLine[1];
+    if (/\bnew\s+(?:[\w.]+\.)?Cookie\s*\(/.test(line)) {
+      for (let i2 = idx - 1; i2 >= Math.max(0, idx - 4); i2--) {
+        const prev = (lines[i2] ?? "").trimEnd();
+        const splitAssign = /\b([A-Za-z_]\w*)\s*=\s*$/.exec(prev);
+        if (splitAssign?.[1]) return splitAssign[1];
+        const prevSame = /\b([A-Za-z_]\w*)\s*=\s*new\s+(?:[\w.]+\.)?Cookie\b/.exec(prev);
+        if (prevSame?.[1]) return prevSame[1];
+      }
+    }
+    return void 0;
+  }
   javaCookieSetterTrue(code, call, setter) {
-    const line = code.split("\n")[(call.location.line ?? 1) - 1] ?? "";
-    const assign = /\b([A-Za-z_]\w*)\s*=\s*new\s+(?:[\w.]+\.)?Cookie\b/.exec(line);
-    const varName = assign?.[1];
+    const lines = code.split("\n");
+    const line = lines[(call.location.line ?? 1) - 1] ?? "";
+    const varName = this.javaCookieVarName(code, call);
     const re = varName ? new RegExp(`\\b${varName}\\.${setter}\\s*\\(\\s*true\\s*\\)`) : new RegExp(`\\.${setter}\\s*\\(\\s*true\\s*\\)`);
     return re.test(varName ? code : line);
   }
@@ -52917,6 +55345,9 @@ var WeakRandomPass = class {
       if (method === "random" && (receiver === "Math" || receiver.endsWith(".Math"))) {
         return "Math.random";
       }
+      if (this.jsIsModuleScopedCryptoRandomUuid(call, ctx)) {
+        return "crypto.randomUUID (module scope)";
+      }
       return null;
     }
     if (language === "go") {
@@ -52954,6 +55385,26 @@ var WeakRandomPass = class {
    * file (i.e. `math/rand` imported unaliased; `crypto/rand` is either not
    * imported or imported under an alias).
    */
+  /**
+   * Module-scoped `crypto.randomUUID()` / `randomUUID()` — entropy fixed at load.
+   */
+  jsIsModuleScopedCryptoRandomUuid(call, ctx) {
+    if (call.method_name !== "randomUUID") return false;
+    if (call.in_method != null && call.in_method !== "") return false;
+    const receiver = call.receiver ?? "";
+    if (receiver === "crypto" || receiver.endsWith(".crypto")) return true;
+    if (!receiver) {
+      const imports = ctx.graph.ir.imports ?? [];
+      return imports.some((imp) => {
+        const pkg = imp.from_package ?? "";
+        if (pkg !== "crypto" && pkg !== "node:crypto") return false;
+        const name2 = imp.imported_name ?? imp.alias ?? "";
+        const alias = imp.alias ?? imp.imported_name ?? "";
+        return name2 === "randomUUID" || alias === "randomUUID";
+      });
+    }
+    return false;
+  }
   goMathRandIsActive(ctx) {
     const imports = ctx.graph.ir.imports ?? [];
     let mathRandUnaliased = false;
@@ -54265,6 +56716,13 @@ var PY_HTTP_RECEIVERS = /* @__PURE__ */ new Set([
 var VERIFY_FALSE_RE = /\bverify\s*=\s*False\b/;
 var REJECT_UNAUTHORIZED_FALSE_RE = /\brejectUnauthorized\s*:\s*false\b/;
 var INSECURE_SKIP_VERIFY_TRUE_RE = /\bInsecureSkipVerify\s*:\s*true\b/;
+var GO_X509_VERIFY_CALL_RE = /\.Verify\s*\(/;
+var GO_INTERMEDIATE_DENYLIST_GUARD_RE = /\b(denylist|denyList|deny_list|blocklist|blockList|blockedIntermediate|blocked_intermediate|deniedIntermediate|deniedIntermediates|denied_intermediate|isDeniedIntermediate|intermediateDenylist|intermediate_denylist)\b/i;
+function goSourceWithoutComments(code) {
+  let s = code.replace(/\/\*[\s\S]*?\*\//g, " ");
+  s = s.replace(/\/\/[^\n]*/g, " ");
+  return s;
+}
 var HOSTNAME_LAMBDA_TRUE_RE = /\(\s*\w+\s*,\s*\w+\s*\)\s*->\s*true\b/;
 var CS_CERT_CALLBACK_TRUE_RE = /\b(ServerCertificateValidationCallback|ServerCertificateCustomValidationCallback|RemoteCertificateValidationCallback)\s*(?:\+?=|\()\s*(?:\([^)]*\)|\w+)\s*=>\s*(?:true\b|\{\s*return\s+true\b)/;
 var CS_DANGEROUS_ACCEPT_RE = /\bDangerousAcceptAnyServerCertificateValidator\b/;
@@ -54273,6 +56731,14 @@ var ALLOW_ALL_HOSTNAME_VERIFIERS = /* @__PURE__ */ new Set([
   "new AllowAllHostnameVerifier()",
   "new NoopHostnameVerifier()"
 ]);
+var JS_CHECK_SERVER_IDENTITY_NOP_RE = /\bcheckServerIdentity\s*:\s*(?:async\s*)?\([^)]*\)\s*=>\s*(?:undefined|null)\b/;
+var JS_CHECK_SERVER_IDENTITY_NOP_FN_RE = /\bcheckServerIdentity\s*:\s*function\s*\([^)]*\)\s*\{\s*return\s+(?:undefined|null)\s*;?\s*\}/;
+var JS_CHECK_SERVER_IDENTITY_DECL_RE = /\bfunction\s+checkServerIdentity\s*\([^)]*\)\s*\{/g;
+var JS_LOOSE_IP_HOST_STRIP_RE = /\.replace\s*\(\s*\/\[\^\\d\.\]\\]\//;
+var JS_CHECK_SERVER_IDENTITY_LOOSE_BODY_RE = /(?:looseIp\s*\(|\.replace\s*\(\s*\/\[\^\\d\.\]\\]\/)[\s\S]*?return\s+undefined\b/;
+var JS_NFKC_NORMALIZE_RE = /\.normalize\s*\(\s*['"]NFKC['"]\s*\)/i;
+var JS_SUBJECT_ALT_NAME_RE = /\bsubjectaltname\b|\bsubjectAltName\b|\baltNames\b|\bDNS:\b|\bIP Address:/i;
+var JS_ISSUER_CHAIN_WALK_RE = /\bissuerCertificate\b/;
 var TlsVerifyDisabledPass = class {
   name = "tls-verify-disabled";
   category = "security";
@@ -54387,6 +56853,18 @@ var TlsVerifyDisabledPass = class {
           });
         }
       }
+      if (/\bx509\./.test(code) && /\bVerifyOptions\b/.test(code) && GO_X509_VERIFY_CALL_RE.test(code) && !GO_INTERMEDIATE_DENYLIST_GUARD_RE.test(goSourceWithoutComments(code))) {
+        for (let i2 = 0; i2 < lines.length; i2++) {
+          if (GO_X509_VERIFY_CALL_RE.test(lines[i2])) {
+            out2.push({
+              line: i2 + 1,
+              pattern: "x509.Verify without intermediate denylist",
+              api: "x509.Certificate.Verify"
+            });
+            break;
+          }
+        }
+      }
     }
     if (language === "python") {
       for (let i2 = 0; i2 < lines.length; i2++) {
@@ -54410,6 +56888,35 @@ var TlsVerifyDisabledPass = class {
             api: "process.env"
           });
         }
+        if (JS_CHECK_SERVER_IDENTITY_NOP_RE.test(l) || JS_CHECK_SERVER_IDENTITY_NOP_FN_RE.test(l)) {
+          out2.push({
+            line: i2 + 1,
+            pattern: "checkServerIdentity => undefined",
+            api: "tls.connect / https.request options"
+          });
+        }
+      }
+      const m = JS_CHECK_SERVER_IDENTITY_NOP_RE.exec(code) ?? JS_CHECK_SERVER_IDENTITY_NOP_FN_RE.exec(code);
+      if (m && m.index !== void 0) {
+        const line = code.slice(0, m.index).split("\n").length;
+        const dupKey = `${line}-checkServerIdentity => undefined`;
+        if (!out2.some((o) => `${o.line}-${o.pattern}` === dupKey)) {
+          out2.push({
+            line,
+            pattern: "checkServerIdentity => undefined",
+            api: "tls.connect / https.request options"
+          });
+        }
+      }
+      for (const weak of this.detectWeakCheckServerIdentityCallbacks(code)) {
+        const dupKey = `${weak.line}-${weak.pattern}`;
+        if (!out2.some((o) => `${o.line}-${o.pattern}` === dupKey)) {
+          out2.push({
+            line: weak.line,
+            pattern: weak.pattern,
+            api: "checkServerIdentity (custom)"
+          });
+        }
       }
     }
     if (language === "csharp") {
@@ -54429,16 +56936,90 @@ var TlsVerifyDisabledPass = class {
     }
     return out2;
   }
+  /** Standalone and inline `checkServerIdentity` with weak identity checks. */
+  detectWeakCheckServerIdentityCallbacks(code) {
+    const hits = [];
+    const fileHasDenylist = GO_INTERMEDIATE_DENYLIST_GUARD_RE.test(code);
+    const declRe = new RegExp(JS_CHECK_SERVER_IDENTITY_DECL_RE.source, "g");
+    let match;
+    while ((match = declRe.exec(code)) !== null) {
+      const openBrace = code.indexOf("{", match.index);
+      if (openBrace < 0) continue;
+      const body2 = this.sliceBalancedBraces(code, openBrace);
+      if (!body2) continue;
+      const prelude = code.slice(Math.max(0, match.index - 800), match.index);
+      const line = code.slice(0, match.index).split("\n").length;
+      const weak = this.classifyWeakCheckServerIdentityBody(
+        body2,
+        prelude,
+        fileHasDenylist
+      );
+      if (weak) hits.push({ line, pattern: weak });
+    }
+    const inlineRe = /\bcheckServerIdentity\s*:\s*(?:async\s*)?function\s*\([^)]*\)\s*\{/g;
+    while ((match = inlineRe.exec(code)) !== null) {
+      const openBrace = code.indexOf("{", match.index);
+      if (openBrace < 0) continue;
+      const body2 = this.sliceBalancedBraces(code, openBrace);
+      if (!body2) continue;
+      const prelude = code.slice(Math.max(0, match.index - 800), match.index);
+      const line = code.slice(0, match.index).split("\n").length;
+      const weak = this.classifyWeakCheckServerIdentityBody(
+        body2,
+        prelude,
+        fileHasDenylist
+      );
+      if (weak) hits.push({ line, pattern: weak });
+    }
+    return hits;
+  }
+  classifyWeakCheckServerIdentityBody(body2, prelude, fileHasDenylist) {
+    if (!/\breturn\s+undefined\b/.test(body2)) return null;
+    const loose = JS_LOOSE_IP_HOST_STRIP_RE.test(body2) || JS_LOOSE_IP_HOST_STRIP_RE.test(prelude) || /\blooseIp\s*\(/.test(body2);
+    if (loose && JS_CHECK_SERVER_IDENTITY_LOOSE_BODY_RE.test(body2)) {
+      return "checkServerIdentity loose host parse => undefined";
+    }
+    const nfkc = JS_NFKC_NORMALIZE_RE.test(body2) || JS_NFKC_NORMALIZE_RE.test(prelude);
+    if (nfkc && /\breturn\s+undefined\b/.test(body2)) {
+      return "checkServerIdentity NFKC host normalize => undefined";
+    }
+    if (JS_SUBJECT_ALT_NAME_RE.test(body2) && /\breturn\s+undefined\b/.test(body2)) {
+      return "checkServerIdentity DNS SAN / IP match => undefined";
+    }
+    if (JS_ISSUER_CHAIN_WALK_RE.test(body2) && !fileHasDenylist && /\breturn\s+undefined\b/.test(body2)) {
+      return "checkServerIdentity issuer chain without denylist => undefined";
+    }
+    return null;
+  }
+  sliceBalancedBraces(code, openIndex) {
+    if (code[openIndex] !== "{") return null;
+    let depth = 0;
+    for (let i2 = openIndex; i2 < code.length; i2++) {
+      const ch = code[i2];
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth === 0) return code.slice(openIndex, i2 + 1);
+      }
+    }
+    return null;
+  }
   fixFor(language, pattern) {
     if (pattern.includes("InsecureSkipVerify")) {
       return "Remove `InsecureSkipVerify: true` \u2014 let Go verify the cert. If you need to trust a private CA, set `RootCAs` to a `*x509.CertPool` containing that CA.";
     }
+    if (pattern.includes("x509.Verify without intermediate denylist")) {
+      return "Before calling `x509.Certificate.Verify`, check the chain (including intermediates) against your blocked-CA / denylist policy. Relying on PKIX verification alone accepts chains that include revoked or blocked intermediates.";
+    }
     if (pattern.includes("verify=False")) {
       return "Remove `verify=False`. To trust a private CA, pass `verify='/path/to/ca.pem'`.";
     }
     if (pattern.includes("rejectUnauthorized")) {
       return "Remove `rejectUnauthorized: false`. To trust a private CA, set the `ca` option to the CA cert(s). Never disable TLS verification globally.";
     }
+    if (pattern.includes("checkServerIdentity")) {
+      return "Implement `checkServerIdentity` to compare the certificate to the intended hostname (or remove the override). Returning `undefined` accepts the connection; loose host/IP folding before that check enables MITM.";
+    }
     if (pattern.includes("NODE_TLS_REJECT_UNAUTHORIZED")) {
       return "Remove the `NODE_TLS_REJECT_UNAUTHORIZED=0` assignment \u2014 it globally disables TLS verification for every outbound HTTPS request.";
     }
@@ -56410,6 +58991,36 @@ function boundedMakeDefIds(defs, code, language) {
   return out2;
 }
 
+// src/analysis/comment-lines.ts
+function makeCommentOnlyLineTest(root, code) {
+  const lines = code.split("\n");
+  const cache = /* @__PURE__ */ new Map();
+  return (line) => {
+    const hit = cache.get(line);
+    if (hit !== void 0) return hit;
+    let result = false;
+    const text = lines[line - 1];
+    if (text !== void 0) {
+      const first = text.search(/\S/);
+      if (first >= 0) {
+        const end = text.trimEnd().length;
+        const node = root.descendantForPosition({ row: line - 1, column: first });
+        let n = node;
+        while (n && !/comment/.test(n.type) && n.startPosition.row === line - 1 && n.startPosition.column === first && n.parent) {
+          n = n.parent;
+        }
+        if (n && /comment/.test(n.type)) {
+          const startsBefore = n.startPosition.row < line - 1 || n.startPosition.row === line - 1 && n.startPosition.column <= first;
+          const endsAfter = n.endPosition.row > line - 1 || n.endPosition.row === line - 1 && n.endPosition.column >= end;
+          result = startsBefore && endsAfter;
+        }
+      }
+    }
+    cache.set(line, result);
+    return result;
+  };
+}
+
 // src/analyzer.ts
 var initialized = false;
 async function initAnalyzer(options = {}) {
@@ -56633,10 +59244,24 @@ function neutralizeOverlongLines(code) {
   }
   return { code: out2, dropped };
 }
+var AnalysisTimeoutError = class extends Error {
+  file;
+  elapsedMs;
+  phase;
+  constructor(file, elapsedMs, phase) {
+    super(`analysis of ${file} timed out after ${elapsedMs}ms (at ${phase})`);
+    this.name = "AnalysisTimeoutError";
+    this.file = file;
+    this.elapsedMs = elapsedMs;
+    this.phase = phase;
+  }
+};
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
   }
+  const fileTimeoutMs = options.fileTimeoutMs ?? 0;
+  const fileDeadline = fileTimeoutMs > 0 ? Date.now() + fileTimeoutMs : 0;
   if (language === "html" || language === "vue") {
     return analyzeMarkupFile(code, filePath, options, language);
   }
@@ -56671,6 +59296,9 @@ async function analyze(code, filePath, language, options = {}) {
   const tree = await parse(code, parseGrammar);
   phaseEnd("parse", tParse);
   try {
+    if (fileDeadline > 0 && Date.now() > fileDeadline) {
+      throw new AnalysisTimeoutError(filePath, Date.now() - (fileDeadline - fileTimeoutMs), "parse");
+    }
     logger.trace("Parsed AST", { rootNodeType: tree.rootNode.type });
     const tParseStatus = phaseStart();
     const parseStatus = extractParseStatus(tree);
@@ -56723,7 +59351,8 @@ async function analyze(code, filePath, language, options = {}) {
     const imports = extractImports(tree, language, nodeCache);
     phaseEnd("extractImports", tImports);
     const tExports = phaseStart();
-    const exports = extractExports(types);
+    if (options.declarationDetail && (language === "typescript" || language === "javascript")) enrichTsDeclarations(tree, types);
+    const exports = (options.declarationDetail && (language === "typescript" || language === "javascript") ? extractTsExports(types) : null) ?? extractExports(types);
     phaseEnd("extractExports", tExports);
     const tCFG = phaseStart();
     const cfg = buildCFG(tree, language, nodeCache);
@@ -56844,7 +59473,14 @@ async function analyze(code, filePath, language, options = {}) {
     if (!disabledPasses.has("unrestricted-file-upload")) pipeline.add(new UnrestrictedFileUploadPass());
     if (!disabledPasses.has("missing-sanitizer-gate")) pipeline.add(new MissingSanitizerGatePass());
     if (!disabledPasses.has("insecure-deserialization-config")) pipeline.add(new InsecureDeserializationConfigPass());
-    const { results, findings } = pipeline.run(graph, code, language, config, options.resources);
+    const { results, findings } = pipeline.run(
+      graph,
+      code,
+      language,
+      config,
+      options.resources,
+      fileDeadline > 0 ? { deadline: fileDeadline, onExpired: (phase) => new AnalysisTimeoutError(filePath, Date.now() - (fileDeadline - fileTimeoutMs), phase) } : void 0
+    );
     const sinkFilter = results.get("sink-filter");
     const interProc = results.get("interprocedural");
     const taint = {
@@ -56865,6 +59501,12 @@ async function analyze(code, filePath, language, options = {}) {
         taint.flows = [...taint.flows ?? [], ...constructionFlows];
       }
     }
+    const isCommentOnlyLine = makeCommentOnlyLineTest(tree.rootNode, code);
+    taint.sinks = taint.sinks.filter((s) => !isCommentOnlyLine(s.line));
+    taint.sources = taint.sources.filter((s) => !isCommentOnlyLine(s.line));
+    if (taint.flows) {
+      taint.flows = taint.flows.filter((f) => !isCommentOnlyLine(f.sink_line) && !isCommentOnlyLine(f.source_line));
+    }
     if (taint.flows && taint.flows.length > 0 && taint.sinks.length > 0) {
       const sinkTagsByKey = /* @__PURE__ */ new Map();
       for (const s of taint.sinks) {
@@ -56893,7 +59535,10 @@ async function analyze(code, filePath, language, options = {}) {
       unresolvedItems: unresolved.length
     });
     emitFindingsInstrumentation(filePath, findings, taint);
-    const verifiedFindings = applyConfidenceFilter(findings, options.includeSpeculative === true);
+    const codeFindings = findings.filter(
+      (f) => f.category !== "security" || f.line <= 1 || !isCommentOnlyLine(f.line)
+    );
+    const verifiedFindings = applyConfidenceFilter(codeFindings, options.includeSpeculative === true);
     const downgradedFindings = applyLibraryApiSurfaceDowngrade(verifiedFindings);
     const profiledFindings = applyProjectProfileTransform(
       downgradedFindings,