circle-ir 4.17.0 → 4.18.1

package/dist/core/circle-ir-core.js

@@ -10390,6 +10390,79 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
       carryBranchDefsOut(popped, scopeStack, alwaysRuns);
       break;
     }
+    case "try_statement":
+    case "try_with_resources_statement": {
+      if (isJavaScript) {
+        const stmtUses = extractUses(stmt, useId, scopeStack, isJavaScript);
+        uses.push(...stmtUses.uses);
+        useId = stmtUses.nextId;
+        break;
+      }
+      scopeStack.push(/* @__PURE__ */ new Map());
+      const resources = stmt.childForFieldName("resources");
+      for (const res of resources?.namedChildren ?? []) {
+        if (!res || res.type !== "resource") continue;
+        const nameNode = res.childForFieldName("name");
+        const value = res.childForFieldName("value");
+        if (value) {
+          const valueUses = extractUses(value, useId, scopeStack, isJavaScript);
+          uses.push(...valueUses.uses);
+          useId = valueUses.nextId;
+        }
+        if (nameNode && nameNode.type === "identifier") {
+          const def = { id: defId++, variable: getNodeText(nameNode), line: nameNode.startPosition.row + 1, column: nameNode.startPosition.column, kind: "local" };
+          defs.push(def);
+          currentScope(scopeStack).set(def.variable, def.id);
+          markDeclared(currentScope(scopeStack), def.variable);
+        } else if (!value) {
+          const resUses = extractUses(res, useId, scopeStack, isJavaScript);
+          uses.push(...resUses.uses);
+          useId = resUses.nextId;
+        }
+      }
+      for (const part of stmt.namedChildren) {
+        if (!part) continue;
+        if (part.type === "block") {
+          const r = processStatement2(part, defId, useId, scopeStack, isJavaScript);
+          defs.push(...r.defs);
+          uses.push(...r.uses);
+          defId = r.nextDefId;
+          useId = r.nextUseId;
+        } else if (part.type === "catch_clause") {
+          scopeStack.push(/* @__PURE__ */ new Map());
+          for (const param of part.namedChildren) {
+            if (!param || param.type !== "catch_formal_parameter") continue;
+            const pname = param.childForFieldName("name");
+            if (pname) {
+              const def = { id: defId++, variable: getNodeText(pname), line: pname.startPosition.row + 1, column: pname.startPosition.column, kind: "local" };
+              defs.push(def);
+              currentScope(scopeStack).set(def.variable, def.id);
+              markDeclared(currentScope(scopeStack), def.variable);
+            }
+          }
+          const body2 = part.childForFieldName("body");
+          if (body2) {
+            const r = processStatement2(body2, defId, useId, scopeStack, isJavaScript);
+            defs.push(...r.defs);
+            uses.push(...r.uses);
+            defId = r.nextDefId;
+            useId = r.nextUseId;
+          }
+          carryBranchDefsOut(scopeStack.pop(), scopeStack, false);
+        } else if (part.type === "finally_clause") {
+          for (const b of part.namedChildren) {
+            if (!b || b.type !== "block") continue;
+            const r = processStatement2(b, defId, useId, scopeStack, isJavaScript);
+            defs.push(...r.defs);
+            uses.push(...r.uses);
+            defId = r.nextDefId;
+            useId = r.nextUseId;
+          }
+        }
+      }
+      carryBranchDefsOut(scopeStack.pop(), scopeStack, false);
+      break;
+    }
     case "else_clause": {
       for (let i2 = 0; i2 < stmt.childCount; i2++) {
         const arm = stmt.child(i2);
@@ -11005,6 +11078,42 @@ function buildBashDFG(tree) {
     defs.push(def);
     currentScope(scopeStack).set(p, def.id);
   }
+  const bashFnDefs = /* @__PURE__ */ new Map();
+  const bashFnByNodeId = /* @__PURE__ */ new Map();
+  for (const fn of findNodes(tree.rootNode, "function_definition")) {
+    const nameNode = fn.childForFieldName("name");
+    if (!nameNode) continue;
+    const fnName = getNodeText(nameNode);
+    if (!fnName || bashFnDefs.has(fnName)) continue;
+    const m = /* @__PURE__ */ new Map();
+    for (const p of positionalParams) {
+      const def = {
+        id: defIdCounter++,
+        variable: p,
+        line: fn.startPosition.row + 1,
+        kind: "param",
+        expression: `bash-fn:${fnName}`
+      };
+      defs.push(def);
+      m.set(p, def.id);
+    }
+    bashFnDefs.set(fnName, m);
+    bashFnByNodeId.set(fn.id, fnName);
+  }
+  const enclosingBashFn = (node) => {
+    let cur = node.parent;
+    while (cur) {
+      if (cur.type === "function_definition") return bashFnByNodeId.get(cur.id) ?? null;
+      cur = cur.parent;
+    }
+    return null;
+  };
+  const positionalDef = (varName, node, fallback) => {
+    if (!positionalParams.includes(varName)) return fallback;
+    const fnName = enclosingBashFn(node);
+    if (!fnName) return fallback;
+    return bashFnDefs.get(fnName)?.get(varName) ?? fallback;
+  };
   walkTree(tree.rootNode, (node) => {
     if (node.type === "variable_assignment") {
       const nameNode = node.childForFieldName("name");
@@ -11057,7 +11166,7 @@ function buildBashDFG(tree) {
       if (varNameNode) {
         const varName = getNodeText(varNameNode);
         if (varName && !varName.startsWith("?") && !varName.startsWith("#")) {
-          let reachingDef = findReachingDef(varName, scopeStack);
+          let reachingDef = positionalDef(varName, node, findReachingDef(varName, scopeStack));
           if (reachingDef === null && !positionalParams.includes(varName)) {
             const def = {
               id: defIdCounter++,
@@ -11081,7 +11190,7 @@ function buildBashDFG(tree) {
       const varNameNode = node.namedChildCount > 0 ? node.namedChild(0) : null;
       if (varNameNode && varNameNode.type === "variable_name") {
         const varName = getNodeText(varNameNode);
-        let reachingDef = findReachingDef(varName, scopeStack);
+        let reachingDef = positionalDef(varName, node, findReachingDef(varName, scopeStack));
         if (reachingDef === null && !positionalParams.includes(varName)) {
           const def = {
             id: defIdCounter++,
@@ -11103,8 +11212,56 @@ function buildBashDFG(tree) {
     }
   });
   const chains = computeChains(defs, uses);
+  chains.push(...bashCallArgChains(tree, bashFnDefs, uses, positionalParams));
   return { defs, uses, chains };
 }
+function bashCallArgChains(tree, bashFnDefs, uses, positionalParams) {
+  const chains = [];
+  if (bashFnDefs.size === 0) return chains;
+  const renumbers = /* @__PURE__ */ new Set();
+  for (const fn of findNodes(tree.rootNode, "function_definition")) {
+    const nameNode = fn.childForFieldName("name");
+    if (!nameNode) continue;
+    if (/\bshift\b|\bset\s+--/.test(getNodeText(fn))) renumbers.add(getNodeText(nameNode));
+  }
+  const usesByLine = /* @__PURE__ */ new Map();
+  for (const u of uses) {
+    const l = usesByLine.get(u.line) ?? [];
+    l.push(u);
+    usesByLine.set(u.line, l);
+  }
+  for (const cmd of findNodes(tree.rootNode, "command")) {
+    const nameNode = cmd.childForFieldName("name");
+    if (!nameNode) continue;
+    const fnDefs = bashFnDefs.get(getNodeText(nameNode));
+    if (!fnDefs) continue;
+    const fnName = getNodeText(nameNode);
+    let position = 0;
+    for (let i2 = 0; i2 < cmd.childCount; i2++) {
+      const arg = cmd.child(i2);
+      if (!arg || arg.id === nameNode.id) continue;
+      if (arg.type.includes("redirect") || arg.type === "heredoc_body" || arg.type === "file_descriptor") continue;
+      const text = getNodeText(arg);
+      if (!text.trim()) continue;
+      position++;
+      const names = /* @__PURE__ */ new Set();
+      const re = /\$\{?([A-Za-z_][A-Za-z0-9_]*|[0-9@*])/g;
+      let m;
+      while ((m = re.exec(text)) !== null) names.add(m[1]);
+      if (names.size === 0) continue;
+      const spreads = /\$\{?[@*]/.test(text);
+      const targets = spreads || renumbers.has(fnName) ? positionalParams.map((p) => fnDefs.get(p)).filter((d) => d !== void 0) : [fnDefs.get(String(position))].filter((d) => d !== void 0);
+      const lineUses = usesByLine.get(arg.startPosition.row + 1) ?? [];
+      for (const name2 of names) {
+        for (const u of lineUses) {
+          if (u.variable !== name2 || u.def_id === null) continue;
+          for (const t of targets) chains.push({ from_def: u.def_id, to_def: t, via: name2 });
+        }
+      }
+    }
+  }
+  return chains;
+}
 function buildRustDFG(tree, cache) {
   const defs = [];
   const uses = [];
@@ -11814,6 +11971,198 @@ function javaReplaceCrLfCoverage(method, rawFrom) {
   return { cr, lf };
 }
 
+// src/analysis/js-crlf-strip.ts
+var MAX_PATTERN_LENGTH = 200;
+var NEUTRAL_AFTER_REPLACE = /* @__PURE__ */ new Set([
+  "replace",
+  "replaceAll",
+  "trim",
+  "trimStart",
+  "trimEnd",
+  "toString",
+  "toLowerCase",
+  "toUpperCase",
+  "slice",
+  "substring"
+]);
+var PROBE = "a\r\rb\n\nc\r\nd\n\re x	";
+function readQuoted(s, i2) {
+  const q = s[i2];
+  if (q !== '"' && q !== "'" && q !== "`") return null;
+  let out2 = "";
+  for (let j = i2 + 1; j < s.length; j++) {
+    const c = s[j];
+    if (c === q) return { value: out2, end: j + 1 };
+    if (q === "`" && c === "$" && s[j + 1] === "{") return null;
+    if (c === "\\") {
+      const n = s[j + 1];
+      if (n === void 0) return null;
+      switch (n) {
+        case "n":
+          out2 += "\n";
+          j++;
+          continue;
+        case "r":
+          out2 += "\r";
+          j++;
+          continue;
+        case "t":
+          out2 += "	";
+          j++;
+          continue;
+        case "0":
+          out2 += "\0";
+          j++;
+          continue;
+        case "x": {
+          const h = /^[0-9a-fA-F]{2}/.exec(s.slice(j + 2, j + 4));
+          if (!h) return null;
+          out2 += String.fromCharCode(parseInt(h[0], 16));
+          j += 3;
+          continue;
+        }
+        case "u": {
+          const h = /^[0-9a-fA-F]{4}/.exec(s.slice(j + 2, j + 6));
+          if (!h) return null;
+          out2 += String.fromCharCode(parseInt(h[0], 16));
+          j += 5;
+          continue;
+        }
+        default:
+          out2 += n;
+          j++;
+          continue;
+      }
+    }
+    if (c === "\n" && q !== "`") return null;
+    out2 += c;
+  }
+  return null;
+}
+function readRegexLiteral(s, i2) {
+  if (s[i2] !== "/") return null;
+  let inClass = false;
+  for (let j = i2 + 1; j < s.length; j++) {
+    const c = s[j];
+    if (c === "\n") return null;
+    if (c === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]") inClass = false;
+      continue;
+    }
+    if (c === "[") {
+      inClass = true;
+      continue;
+    }
+    if (c === "/") {
+      const flags2 = /^[dgimsuvy]*/.exec(s.slice(j + 1))[0];
+      return { source: s.slice(i2 + 1, j), flags: flags2, end: j + 1 + flags2.length };
+    }
+  }
+  return null;
+}
+var skipWs = (s, i2) => {
+  while (i2 < s.length && /\s/.test(s[i2])) i2++;
+  return i2;
+};
+function parseSteps(chainText) {
+  const steps = [];
+  const callRe = /\.\s*(replaceAll|replace)\s*\(/g;
+  let m;
+  while ((m = callRe.exec(chainText)) !== null) {
+    const kind = m[1];
+    let i2 = skipWs(chainText, m.index + m[0].length);
+    let pattern;
+    const rx = readRegexLiteral(chainText, i2);
+    if (rx) {
+      if (rx.source.length > MAX_PATTERN_LENGTH) return null;
+      try {
+        pattern = new RegExp(rx.source, rx.flags);
+      } catch {
+        return null;
+      }
+      i2 = rx.end;
+    } else {
+      const str = readQuoted(chainText, i2);
+      if (!str) return null;
+      pattern = str.value;
+      i2 = str.end;
+    }
+    i2 = skipWs(chainText, i2);
+    if (chainText[i2] !== ",") return null;
+    i2 = skipWs(chainText, i2 + 1);
+    const rep = readQuoted(chainText, i2);
+    if (!rep) return null;
+    i2 = skipWs(chainText, rep.end);
+    if (chainText[i2] !== ")") return null;
+    steps.push({ kind, pattern, replacement: rep.value });
+    callRe.lastIndex = i2 + 1;
+  }
+  return steps;
+}
+function run2(steps, input) {
+  let s = input;
+  try {
+    for (const st of steps) {
+      if (st.kind === "replaceAll" && st.pattern instanceof RegExp && !st.pattern.global) return null;
+      s = st.kind === "replaceAll" ? s.replaceAll(st.pattern, st.replacement) : s.replace(st.pattern, st.replacement);
+    }
+  } catch {
+    return null;
+  }
+  return s;
+}
+function jsReplaceChainVerdict(chainText) {
+  const steps = parseSteps(chainText);
+  if (!steps || steps.length === 0) return "undecided";
+  const first = chainText.search(/\.\s*(?:replaceAll|replace)\s*\(/);
+  for (const seg of chainText.slice(first + 1).matchAll(/\.\s*([A-Za-z_$][\w$]*)\s*\(/g)) {
+    if (!NEUTRAL_AFTER_REPLACE.has(seg[1])) return "undecided";
+  }
+  const out2 = run2(steps, PROBE);
+  if (out2 === null) return "undecided";
+  return out2.includes("\r") || out2.includes("\n") ? "leaves-crlf" : "strips-crlf";
+}
+function jsChainTextAt(sourceLines, line, column) {
+  const text = [(sourceLines[line - 1] ?? "").slice(column), ...sourceLines.slice(line, line + 7)].join("\n");
+  let depth = 0;
+  let prevSig = "";
+  let i2 = 0;
+  for (; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (c === '"' || c === "'" || c === "`") {
+      for (i2++; i2 < text.length && text[i2] !== c; i2++) if (text[i2] === "\\") i2++;
+      prevSig = c;
+      continue;
+    }
+    if (c === "/" && depth > 0 && (prevSig === "(" || prevSig === ",")) {
+      const rx = readRegexLiteral(text, i2);
+      if (rx) {
+        i2 = rx.end - 1;
+        prevSig = "/";
+        continue;
+      }
+    }
+    if (c === "(" || c === "[" || c === "{") {
+      depth++;
+      prevSig = c;
+      continue;
+    }
+    if (c === ")" || c === "]" || c === "}") {
+      if (depth === 0) break;
+      depth--;
+      prevSig = c;
+      continue;
+    }
+    if (depth === 0 && !/[\w$.\s]/.test(c)) break;
+    if (!/\s/.test(c)) prevSig = c;
+  }
+  return text.slice(0, i2);
+}
+
 // src/analysis/passes/language-sources-pass.ts
 var JINJA_LITERAL_ARG_RE_FRAG = `(?:"[^"\\\\]*"|'[^'\\\\]*')`;
 var JINJA_SAFE_RTS_RE = new RegExp(
@@ -12597,6 +12946,10 @@ var DEFAULT_SOURCES = [
   { method: "get", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
   { method: "hget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
   { method: "mget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
+  // Node redis clients are often bound to `cache` from `createClient()`; class
+  // `cache` is scoped to JS/TS (Python Django cache above) and Map.get is
+  // filtered in sink-filter-pass (#818 src14).
+  { method: "get", class: "cache", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
   { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
   { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
@@ -12776,7 +13129,9 @@ var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
   // on arg[1] (the *Cookie) catches struct-literal composite tainting.
   { method: "SetCookie", class: "http", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
   // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
-  { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] }
+  { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
+  // --- Rust: actix-session / tower-sessions write -------------------------
+  { method: "insert", class: "Session", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["rust"] }
 ];
 var DEFAULT_SINKS = [
   // SQL Injection (CWE-89)
@@ -13437,7 +13792,9 @@ var DEFAULT_SINKS = [
   { method: "addParametersToContext", class: "StaticParametersInterceptor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "build", class: "HttpParameters", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   // Cron expression parsing (DoS/ReDoS)
-  { method: "parse", class: "CronParser", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0] },
+  // cognium-dev#998 — Java cron-utils `CronParser`; scoped to Java so a JS/TS
+  // `parser.parse(...)` (tree-sitter, a lockfile parser) never matches it by name.
+  { method: "parse", class: "CronParser", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "isValid", class: "CronValidator", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0] },
   // ff4j feature flags
   { method: "check", class: "FF4j", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0] },
@@ -13534,9 +13891,13 @@ var DEFAULT_SINKS = [
   { method: "selectNodes", class: "Node", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0] },
   { method: "selectSingleNode", class: "Node", type: "xpath_injection", cwe: "CWE-643", severity: "high", arg_positions: [0] },
   // XXE - XML External Entity (CWE-611)
-  { method: "parse", class: "DocumentBuilder", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
-  { method: "parse", class: "SAXParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
-  { method: "parse", class: "XMLReader", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
+  // cognium-dev#998 — JAXP parsers are JVM classes. Scoped to Java so the
+  // receiver-name heuristic (`parser` → SAXParser) cannot turn a JS/TS
+  // `parser.parse(text)` into an XXE sink. JS/TS XML parsers (sax, xml2js,
+  // libxmljs, DOMParser) have their own entries.
+  { method: "parse", class: "DocumentBuilder", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "parse", class: "SAXParser", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "parse", class: "XMLReader", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0], languages: ["java"] },
   { method: "unmarshal", class: "Unmarshaller", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
   { method: "newTransformer", class: "TransformerFactory", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
   { method: "transform", class: "Transformer", type: "xxe", cwe: "CWE-611", severity: "high", arg_positions: [0] },
@@ -13791,6 +14152,46 @@ var DEFAULT_SINKS = [
   { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  // DuckDB from JS/TS: `@duckdb/node-api` (DuckDBConnection), the classic
+  // `duckdb` / `duckdb-async` bindings (Database / Connection) and
+  // `react-native-duckdb` (Database / Transaction). The method names are
+  // generic and the receivers come from factories (`await instance.connect()`,
+  // `open({...})`), so the receiver cannot be typed: the import is the gate
+  // (`requires_import`). Only the SQL text (arg 0) is a sink — values passed
+  // as bound parameters (`run(sql, [v])`, `execute(sql, params)`,
+  // `executeNamed(sql, {k: v})`, `stmt.bind(...)`) are parameterised and do
+  // not reach it.
+  { method: "run", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api", "duckdb", "duckdb-async"] },
+  { method: "prepare", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api", "duckdb", "duckdb-async", "react-native-duckdb"] },
+  { method: "stream", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api", "duckdb", "duckdb-async", "react-native-duckdb"] },
+  { method: "runAndRead", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "runAndReadAll", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "runAndReadUntil", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "streamAndRead", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "streamAndReadAll", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "streamAndReadUntil", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "start", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "startStream", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "extractStatements", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["@duckdb/node-api"] },
+  { method: "all", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "each", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "exec", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "arrowIPCAll", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "arrowIPCStream", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["duckdb", "duckdb-async"] },
+  { method: "execute", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  { method: "executeSync", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  { method: "executeNamed", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  { method: "executeSyncNamed", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  { method: "streamNamed", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["react-native-duckdb"] },
+  // RxDB (Mango queries, any storage incl. SQLite): a selector or query
+  // object, a field name passed to the query builder, or a `$regex` pattern
+  // under caller control is NoSQL operator injection (CWE-943). Gated on the
+  // `rxdb` import for the same reason as DuckDB above. `find` is already a
+  // classless JS NoSQL sink in the JavaScript plugin.
+  { method: "findOne", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["rxdb"] },
+  { method: "count", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["rxdb"] },
+  { method: "where", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["rxdb"] },
+  { method: "regex", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"], requires_import: ["rxdb"] },
   // TypeORM QueryBuilder raw fragments (CWE-89). TypeORM's raw `.query(sql)`
   // escape hatch is already covered by the classless `query` sink in the JS
   // plugin (getBuiltinSinks), so it is NOT re-registered here — the dedup
@@ -13901,6 +14302,8 @@ var DEFAULT_SINKS = [
   { method: "get", class: "http", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "request", class: "https", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "get", class: "https", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // Node.js dns.promises (CWE-918 / NUL-in-name SSRF class — #895)
+  { method: "resolve", class: "dns.promises", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // needle library (used in NodeGoat)
   { method: "get", class: "needle", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "needle", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -14395,7 +14798,7 @@ var DEFAULT_SINKS = [
   // receiver-taint or operator-LHS-taint tracking — the format string is the
   // receiver, not an argument. Deferred to Sprint 6 (#86 follow-up).
   // C-style: printf / fprintf / sprintf / snprintf via ctypes/cffi.
-  { method: "printf", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "printf", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [0], languages: ["python", "rust"] },
   { method: "fprintf", type: "format_string", cwe: "CWE-134", severity: "high", arg_positions: [1], languages: ["python"] },
   // Go: fmt.Sprintf/Printf/Fprintf/Errorf — format string is first/second arg
   { method: "Sprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
@@ -15464,198 +15867,6 @@ function getDefaultConfig() {
   };
 }
 
-// src/analysis/js-crlf-strip.ts
-var MAX_PATTERN_LENGTH = 200;
-var NEUTRAL_AFTER_REPLACE = /* @__PURE__ */ new Set([
-  "replace",
-  "replaceAll",
-  "trim",
-  "trimStart",
-  "trimEnd",
-  "toString",
-  "toLowerCase",
-  "toUpperCase",
-  "slice",
-  "substring"
-]);
-var PROBE = "a\r\rb\n\nc\r\nd\n\re x	";
-function readQuoted(s, i2) {
-  const q = s[i2];
-  if (q !== '"' && q !== "'" && q !== "`") return null;
-  let out2 = "";
-  for (let j = i2 + 1; j < s.length; j++) {
-    const c = s[j];
-    if (c === q) return { value: out2, end: j + 1 };
-    if (q === "`" && c === "$" && s[j + 1] === "{") return null;
-    if (c === "\\") {
-      const n = s[j + 1];
-      if (n === void 0) return null;
-      switch (n) {
-        case "n":
-          out2 += "\n";
-          j++;
-          continue;
-        case "r":
-          out2 += "\r";
-          j++;
-          continue;
-        case "t":
-          out2 += "	";
-          j++;
-          continue;
-        case "0":
-          out2 += "\0";
-          j++;
-          continue;
-        case "x": {
-          const h = /^[0-9a-fA-F]{2}/.exec(s.slice(j + 2, j + 4));
-          if (!h) return null;
-          out2 += String.fromCharCode(parseInt(h[0], 16));
-          j += 3;
-          continue;
-        }
-        case "u": {
-          const h = /^[0-9a-fA-F]{4}/.exec(s.slice(j + 2, j + 6));
-          if (!h) return null;
-          out2 += String.fromCharCode(parseInt(h[0], 16));
-          j += 5;
-          continue;
-        }
-        default:
-          out2 += n;
-          j++;
-          continue;
-      }
-    }
-    if (c === "\n" && q !== "`") return null;
-    out2 += c;
-  }
-  return null;
-}
-function readRegexLiteral(s, i2) {
-  if (s[i2] !== "/") return null;
-  let inClass = false;
-  for (let j = i2 + 1; j < s.length; j++) {
-    const c = s[j];
-    if (c === "\n") return null;
-    if (c === "\\") {
-      j++;
-      continue;
-    }
-    if (inClass) {
-      if (c === "]") inClass = false;
-      continue;
-    }
-    if (c === "[") {
-      inClass = true;
-      continue;
-    }
-    if (c === "/") {
-      const flags2 = /^[dgimsuvy]*/.exec(s.slice(j + 1))[0];
-      return { source: s.slice(i2 + 1, j), flags: flags2, end: j + 1 + flags2.length };
-    }
-  }
-  return null;
-}
-var skipWs = (s, i2) => {
-  while (i2 < s.length && /\s/.test(s[i2])) i2++;
-  return i2;
-};
-function parseSteps(chainText) {
-  const steps = [];
-  const callRe = /\.\s*(replaceAll|replace)\s*\(/g;
-  let m;
-  while ((m = callRe.exec(chainText)) !== null) {
-    const kind = m[1];
-    let i2 = skipWs(chainText, m.index + m[0].length);
-    let pattern;
-    const rx = readRegexLiteral(chainText, i2);
-    if (rx) {
-      if (rx.source.length > MAX_PATTERN_LENGTH) return null;
-      try {
-        pattern = new RegExp(rx.source, rx.flags);
-      } catch {
-        return null;
-      }
-      i2 = rx.end;
-    } else {
-      const str = readQuoted(chainText, i2);
-      if (!str) return null;
-      pattern = str.value;
-      i2 = str.end;
-    }
-    i2 = skipWs(chainText, i2);
-    if (chainText[i2] !== ",") return null;
-    i2 = skipWs(chainText, i2 + 1);
-    const rep = readQuoted(chainText, i2);
-    if (!rep) return null;
-    i2 = skipWs(chainText, rep.end);
-    if (chainText[i2] !== ")") return null;
-    steps.push({ kind, pattern, replacement: rep.value });
-    callRe.lastIndex = i2 + 1;
-  }
-  return steps;
-}
-function run2(steps, input) {
-  let s = input;
-  try {
-    for (const st of steps) {
-      if (st.kind === "replaceAll" && st.pattern instanceof RegExp && !st.pattern.global) return null;
-      s = st.kind === "replaceAll" ? s.replaceAll(st.pattern, st.replacement) : s.replace(st.pattern, st.replacement);
-    }
-  } catch {
-    return null;
-  }
-  return s;
-}
-function jsReplaceChainVerdict(chainText) {
-  const steps = parseSteps(chainText);
-  if (!steps || steps.length === 0) return "undecided";
-  const first = chainText.search(/\.\s*(?:replaceAll|replace)\s*\(/);
-  for (const seg of chainText.slice(first + 1).matchAll(/\.\s*([A-Za-z_$][\w$]*)\s*\(/g)) {
-    if (!NEUTRAL_AFTER_REPLACE.has(seg[1])) return "undecided";
-  }
-  const out2 = run2(steps, PROBE);
-  if (out2 === null) return "undecided";
-  return out2.includes("\r") || out2.includes("\n") ? "leaves-crlf" : "strips-crlf";
-}
-function jsChainTextAt(sourceLines, line, column) {
-  const text = [(sourceLines[line - 1] ?? "").slice(column), ...sourceLines.slice(line, line + 7)].join("\n");
-  let depth = 0;
-  let prevSig = "";
-  let i2 = 0;
-  for (; i2 < text.length; i2++) {
-    const c = text[i2];
-    if (c === '"' || c === "'" || c === "`") {
-      for (i2++; i2 < text.length && text[i2] !== c; i2++) if (text[i2] === "\\") i2++;
-      prevSig = c;
-      continue;
-    }
-    if (c === "/" && depth > 0 && (prevSig === "(" || prevSig === ",")) {
-      const rx = readRegexLiteral(text, i2);
-      if (rx) {
-        i2 = rx.end - 1;
-        prevSig = "/";
-        continue;
-      }
-    }
-    if (c === "(" || c === "[" || c === "{") {
-      depth++;
-      prevSig = c;
-      continue;
-    }
-    if (c === ")" || c === "]" || c === "}") {
-      if (depth === 0) break;
-      depth--;
-      prevSig = c;
-      continue;
-    }
-    if (depth === 0 && !/[\w$.\s]/.test(c)) break;
-    if (!/\s/.test(c)) prevSig = c;
-  }
-  return text.slice(0, i2);
-}
-
 // src/analysis/constant-propagation/patterns.ts
 var TAINT_PATTERNS = [
   // HTTP Sources (Servlet API)
@@ -16045,13 +16256,35 @@ function dropCSharpObjectCarriedWaypoints(sinks, calls) {
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code, imports) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language, imports);
-  let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  let sinkPatterns = config.sinks.filter((p) => sinkPatternImportApplies(p, imports));
+  sinkPatterns = expandPromisifyAliases(sinkPatterns, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
   const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines, language);
   return { sources, sinks: gatedSinks, sanitizers };
 }
+function isBoundParameterCall(call, pattern, sourceLines) {
+  if (!pattern.requires_import || pattern.type !== "sql_injection") return false;
+  const first = call.arguments[0]?.expression?.trim() ?? "";
+  if (first.startsWith("[") || first.startsWith("{")) return true;
+  const receiver = call.receiver;
+  if (!receiver || !sourceLines || !/^[A-Za-z_$][\w$]*$/.test(receiver)) return false;
+  const assignedFromPrepare = new RegExp(
+    `\\b${receiver.replace(/\$/g, "\\$")}\\s*(?::[^=]+)?=\\s*(?:await\\s+)?[\\w$.]+\\.prepare\\s*\\(`
+  );
+  return sourceLines.some((line) => assignedFromPrepare.test(line));
+}
+function sinkPatternImportApplies(pattern, imports) {
+  const required = pattern.requires_import;
+  if (!required || required.length === 0) return true;
+  if (!imports || imports.length === 0) return false;
+  return imports.some((imp) => {
+    const from = imp.from_package;
+    if (!from) return false;
+    return required.some((m) => from === m || from.startsWith(m + "/"));
+  });
+}
 function sinkPatternAppliesTo(pattern, language) {
   if (language === void 0) return true;
   if (pattern.languages && pattern.languages.length > 0 && !pattern.languages.includes(language)) {
@@ -16469,6 +16702,46 @@ function isInterproceduralTaintableType(typeName, language) {
     const leaf = baseType.split(".").pop() ?? baseType;
     if (csharpTaintable.includes(baseType) || csharpTaintable.includes(leaf)) return true;
   }
+  if (language === "rust") {
+    const trimmed = typeName.trim();
+    const unref = trimmed.replace(/^&mut\s+/, "").replace(/^&\s*/, "");
+    const rustBase = unref.split("<")[0].trim();
+    const rustScalars = [
+      "String",
+      "str",
+      "bool",
+      "char",
+      "i8",
+      "i16",
+      "i32",
+      "i64",
+      "i128",
+      "isize",
+      "u8",
+      "u16",
+      "u32",
+      "u64",
+      "u128",
+      "usize",
+      "f32",
+      "f64"
+    ];
+    if (rustScalars.includes(rustBase)) return true;
+    if (rustBase === "()" || rustBase === "!") return false;
+    if (unref.startsWith("Vec<") || unref.startsWith("Option<") || unref.startsWith("Result<")) {
+      return true;
+    }
+    if (/^[A-Z][A-Za-z0-9_]*$/.test(rustBase)) return true;
+  }
+  if (language === "javascript" || language === "typescript") {
+    const trimmed = typeName.trim();
+    const jsScalars = ["string", "number", "boolean", "bigint", "any", "unknown", "object"];
+    if (jsScalars.includes(baseType)) return true;
+    if (trimmed.startsWith("{") || trimmed.startsWith("[") || trimmed.startsWith("(")) return true;
+    if (/\bRecord\s*</.test(trimmed)) return true;
+    if (["void", "undefined", "null", "never"].includes(baseType)) return false;
+    if (/^[A-Za-z_][\w.$]*$/.test(baseType)) return true;
+  }
   if (typeName.endsWith("[]")) {
     const elementType = typeName.slice(0, -2);
     if (elementType === "String" || elementType === "Object" || elementType === "byte") {
@@ -16583,6 +16856,31 @@ function isSafeGoExecCommandCall(call, pattern, language) {
       return false;
     }
   }
+  if (program === "git") {
+    const subcommandArgPos = pattern.method === "CommandContext" ? 2 : 1;
+    const subcommandArg = call.arguments.find((a) => a.position === subcommandArgPos);
+    let subcommand;
+    if (subcommandArg?.literal !== null && subcommandArg?.literal !== void 0) {
+      subcommand = String(subcommandArg.literal);
+    } else {
+      const expr = (subcommandArg?.expression ?? "").trim();
+      if (expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'")) {
+        subcommand = expr.slice(1, -1);
+      }
+    }
+    if (subcommand === "ls-remote") {
+      const hasEndOfOptions = call.arguments.some((a) => {
+        if (a.literal !== null && a.literal !== void 0) {
+          return String(a.literal) === "--";
+        }
+        const expr = (a.expression ?? "").trim();
+        return expr === '"--"' || expr === "'--'" || expr === "`--`";
+      });
+      if (!hasEndOfOptions) {
+        return false;
+      }
+    }
+  }
   return true;
 }
 function isSafeJSChildProcessCall(call, pattern, language) {
@@ -16986,6 +17284,29 @@ function isRegexReceiver(receiver, sourceLines) {
   const decl = new RegExp(`(?:const|let|var)\\s+${escapeRe(r)}\\s*=\\s*(?:/|(?:new\\s+)?RegExp\\s*\\()`);
   return sourceLines.some((l) => decl.test(l));
 }
+function isNavigationReceiverName(receiver) {
+  const r = (receiver ?? "").trim();
+  if (!r) return false;
+  const last = r.slice(r.lastIndexOf(".") + 1).replace(/\(\)$/, "");
+  return /router|history|navigat|^nav$/i.test(last);
+}
+function isInMemoryMapGetReceiver(receiver, sourceLines) {
+  const raw = (receiver ?? "").trim();
+  if (!raw || !sourceLines) return false;
+  if (/\.properties$/i.test(raw)) return true;
+  const lastDot = raw.lastIndexOf(".");
+  const r = (lastDot >= 0 ? raw.slice(lastDot + 1) : raw).trim();
+  if (/^(properties|memoryCache)$/i.test(r)) return true;
+  if (!/^[A-Za-z_$][\w$]*$/.test(r)) return false;
+  const n = escapeRe(r);
+  const mapCtor = new RegExp(
+    `\\b${n}\\s*(?::[^=;]*)?=\\s*new\\s+(?:Weak)?Map\\s*(?:<.*>)?\\s*\\(`
+  );
+  const mapType = new RegExp(
+    `\\b${n}\\s*\\??\\s*:\\s*(?:Readonly)?(?:Weak)?Map\\s*<`
+  );
+  return sourceLines.some((l) => mapCtor.test(l) || mapType.test(l));
+}
 function isDeclaredFunctionReference(arg, sourceLines) {
   if (arg.literal !== null && arg.literal !== void 0) return false;
   if (!sourceLines) return false;
@@ -17190,6 +17511,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isParameterizedQueryCall(call, pattern)) {
           continue;
         }
+        if ((language === "javascript" || language === "typescript") && (pattern.type === "sql_injection" || pattern.type === "nosql_injection") && call.arguments.length === 0 && pattern.arg_positions.every((p) => p >= 0)) {
+          continue;
+        }
+        if (isBoundParameterCall(call, pattern, sourceLines)) {
+          continue;
+        }
         if (isSafePythonSubprocessCall(call, pattern, language)) {
           continue;
         }
@@ -17247,9 +17574,15 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isArgumentlessJsResponseWriter(call, pattern, language)) {
           continue;
         }
+        if (pattern.type === "open_redirect" && (language === "javascript" || language === "typescript") && (call.method_name === "push" || call.method_name === "replace") && (pattern.class ?? "").toLowerCase() === "router" && !call.receiver_type && !call.receiver_type_fqn && !isNavigationReceiverName(call.receiver)) {
+          continue;
+        }
         if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
+        if (pattern.type === "sql_injection" && call.method_name === "get" && pattern.class === "Connection" && (language === "javascript" || language === "typescript") && isInMemoryMapGetReceiver(call.receiver, sourceLines)) {
+          continue;
+        }
         if (pattern.type === "code_injection" && language === "python" && call.method_name === "compile" && call.receiver && call.receiver !== "builtins") {
           continue;
         }
@@ -17266,7 +17599,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
           continue;
         }
         const location = formatCallLocation(call);
-        const key = `${location}:${call.location.line}:${pattern.cwe}`;
+        const key = `${location}:${call.location.line}:${call.location.column}:${pattern.cwe}`;
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
@@ -17277,6 +17610,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             cwe: pattern.cwe,
             location,
             line: call.location.line,
+            callColumn: call.location.column,
             confidence,
             method: call.method_name,
             argPositions: pattern.arg_positions,
@@ -17314,6 +17648,15 @@ function matchesSourcePattern(call, pattern, language, types, imports) {
         return false;
       }
     }
+    if (!pattern.class && pattern.return_tainted && pattern.method && (language === "javascript" || language === "typescript")) {
+      const expressRequestAccessors = /* @__PURE__ */ new Set(["query", "body", "params", "headers", "cookies"]);
+      if (expressRequestAccessors.has(pattern.method)) {
+        const recv = call.receiver?.toLowerCase() ?? "";
+        if (recv !== "req" && recv !== "request" && recv !== "ctx") {
+          return false;
+        }
+      }
+    }
     return pattern.return_tainted === true;
   }
   return false;
@@ -17407,6 +17750,7 @@ var SAFE_RECEIVERS_BY_METHOD = {
     "database",
     "sqlite",
     "conn",
+    "con",
     "connection",
     "client",
     "pool",
@@ -17683,7 +18027,7 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       }
     }
   }
-  if (!pattern.class && call.receiver) {
+  if (!pattern.class && call.receiver && !pattern.requires_import) {
     if (isKnownSafeReceiverForMethod(call.receiver, call.method_name, pattern.type)) {
       return false;
     }
@@ -18416,6 +18760,8 @@ function javaReplaceChainCredit(chainText) {
   let lf = false;
   let lt = false;
   let gt = false;
+  let openBrace = false;
+  let closeBrace = false;
   for (const m of chainText.matchAll(JAVA_REPLACE_ARGS_RE)) {
     const kind = m[1];
     const rawFrom = m[2] ?? m[3] ?? "";
@@ -18426,10 +18772,13 @@ function javaReplaceChainCredit(chainText) {
     if (cov.lf) lf = true;
     if (from === "<" && to.startsWith("&")) lt = true;
     if (from === ">" && to.startsWith("&")) gt = true;
+    if (from === "{") openBrace = true;
+    if (from === "}") closeBrace = true;
   }
   const out2 = [];
   if (cr && lf) out2.push("log_injection");
   if (lt && gt) out2.push("xss");
+  if (openBrace && closeBrace) out2.push("code_injection");
   return out2;
 }
 function matchesSanitizerPattern(call, pattern) {
@@ -20543,6 +20892,9 @@ var ConstantPropagator = class _ConstantPropagator {
       case "assignment_statement":
         this.handleGoAssignment(node);
         return false;
+      case "var_declaration":
+        this.handleGoVarDeclaration(node);
+        return false;
       case "update_expression":
         this.handleUpdateExpression(node);
         return false;
@@ -20950,6 +21302,64 @@ var ConstantPropagator = class _ConstantPropagator {
    * helper that always returns a constant — clears the variable. Anything else stops being tracked here, which is what Go
    * assignments got before this handler existed: the DFG decides.
    */
+  /** `var x = expr` / `var x T = expr` — same clean/taint rules as `:=` (#783). */
+  handleGoVarDeclaration(node) {
+    for (let i2 = 0; i2 < node.childCount; i2++) {
+      const spec = node.child(i2);
+      if (!spec || spec.type !== "var_spec") continue;
+      const nameNode = spec.childForFieldName("name");
+      let valueNode = spec.childForFieldName("value");
+      if (!nameNode || !valueNode) continue;
+      const names = [];
+      if (nameNode.type === "identifier") {
+        names.push(getNodeText2(nameNode, this.source));
+      } else if (nameNode.type === "identifier_list") {
+        for (const c of nameNode.children) {
+          if (c.type === "identifier") names.push(getNodeText2(c, this.source));
+        }
+      }
+      if (valueNode.type === "expression_list") {
+        valueNode = valueNode.children.find((c) => c.type !== "," && c.type !== "comment") ?? valueNode;
+      }
+      if (names.length === 0) continue;
+      const line = getNodeLine(node);
+      for (const varName of names) {
+        if (varName === "_") continue;
+        const scopedName = this.getScopedName(varName);
+        this.goScopedNames.add(scopedName);
+        if (this.isTaintedExpression(valueNode)) {
+          this.goUnknownVars.add(scopedName);
+          this.tainted.add(scopedName);
+          this.sanitizedVars.delete(scopedName);
+          this.sanitizedVarUncovered.delete(scopedName);
+          this.definitionNodes.set(scopedName, valueNode);
+          this.symbols.set(scopedName, createUnknown(line));
+          continue;
+        }
+        if (!this.isGoKnownCleanRhs(valueNode) || this.goUnknownVars.has(scopedName)) {
+          this.goUnknownVars.add(scopedName);
+          this.symbols.delete(scopedName);
+          this.sanitizedVars.delete(scopedName);
+          this.sanitizedVarUncovered.delete(scopedName);
+          if (!this.inConditionalBranch) {
+            this.tainted.delete(scopedName);
+            this.definitionNodes.delete(scopedName);
+          }
+          continue;
+        }
+        if (this.inConditionalBranch) {
+          this.goUnknownVars.add(scopedName);
+          this.symbols.delete(scopedName);
+          continue;
+        }
+        this.tainted.delete(scopedName);
+        this.definitionNodes.delete(scopedName);
+        this.symbols.set(scopedName, this.evaluateExpression(valueNode));
+        this.sanitizedVars.delete(scopedName);
+        this.sanitizedVarUncovered.delete(scopedName);
+      }
+    }
+  }
   handleGoAssignment(node) {
     const left = node.childForFieldName("left");
     const right = node.childForFieldName("right");
@@ -21766,6 +22176,24 @@ var ConstantPropagator = class _ConstantPropagator {
     cache.set(rootId, false);
     return false;
   }
+  /** Is an argument of `call` an inline sanitizer call over tainted input (itself possibly nested)? */
+  argIsSanitizedTaint(call) {
+    const argsNode = call.childForFieldName("arguments");
+    if (!argsNode) return false;
+    for (const arg of argsNode.children) {
+      if (arg.type !== "method_invocation") continue;
+      const name2 = arg.childForFieldName("name");
+      if (!name2 || !SANITIZER_METHODS.has(getNodeText2(name2, this.source))) continue;
+      const inner = arg.childForFieldName("arguments");
+      if (!inner) continue;
+      for (const a of inner.children) {
+        if (a.type === "(" || a.type === ")" || a.type === ",") continue;
+        if (this.isTaintedExpression(a)) return true;
+      }
+      if (this.argIsSanitizedTaint(arg)) return true;
+    }
+    return false;
+  }
   isTaintedExpressionStep(node) {
     const text = getNodeText2(node, this.source);
     if (node.type === "method_invocation") {
@@ -21773,6 +22201,9 @@ var ConstantPropagator = class _ConstantPropagator {
       const objectNode = node.childForFieldName("object");
       if (nameNode) {
         const methodName = getNodeText2(nameNode, this.source);
+        if (ANTI_SANITIZER_METHODS.has(methodName) && this.argIsSanitizedTaint(node)) {
+          return true;
+        }
         if (SANITIZER_METHODS.has(methodName) && !this.localNonSanitizing.has(methodName)) {
           return false;
         }