circle-ir 4.17.0 → 4.18.1

package/dist/analysis/passes/interprocedural-pass.js

@@ -18,6 +18,7 @@ import { attachSourceLineCode } from '../taint-matcher.js';
 import { shouldGateInterproceduralParam } from '../entry-point-detection.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
 import { identifierOutsideSanitizerCalls } from '../taint-propagation.js';
+import { buildJavaTaintedVars, computeDeadJavaBranchLines } from './language-sources-pass.js';
 export class InterproceduralPass {
     name = 'interprocedural';
     category = 'security';
@@ -150,6 +151,7 @@ export class InterproceduralPass {
                     }
                 }
             }
+            appendCalleeSourceCallerSinkFlows(graph, sources, sinks, interProc, additionalFlows, language === 'java' ? ctx.code : undefined, language === 'java' ? constProp : undefined);
             const taintBridges = findTaintBridges(interProc);
             interprocedural = {
                 tainted_methods: Array.from(interProc.taintedMethods),
@@ -348,6 +350,566 @@ export class InterproceduralPass {
  * The sink is reached when its statement mentions a derived name that is not
  * sanitized or guarded there.
  */
+/**
+ * True when constant propagation tracked `variable` in `method` and did not
+ * mark it tainted. Only a tracked symbol counts: "not in the tainted set" alone
+ * also means "never looked at" (see `isFalsePositive` reason 3).
+ */
+function assigneeIsConstPropClean(constProp, method, variable) {
+    if (!method)
+        return false;
+    const scoped = `${method}:${variable}`;
+    if (!constProp.symbols.has(scoped))
+        return false;
+    if (constProp.tainted.has(scoped))
+        return false;
+    for (const t of constProp.tainted) {
+        if (t.startsWith(`${method}:`) && t.endsWith(`:${variable}`))
+            return false;
+    }
+    if (constProp.sanitizedVarUncovered?.has(scoped))
+        return false;
+    return true;
+}
+function constPropTaints(constProp, method, variable) {
+    if (constProp.tainted.has(`${method}:${variable}`))
+        return true;
+    for (const t of constProp.tainted) {
+        if (t.startsWith(`${method}:`) && t.endsWith(`:${variable}`))
+            return true;
+    }
+    return false;
+}
+/** Does a call on `line` in `method` take an argument const-prop holds tainted? */
+function callArgumentIsConstPropTainted(graph, constProp, method, line) {
+    if (!method)
+        return false;
+    for (const call of graph.ir.calls) {
+        if (call.location.line !== line)
+            continue;
+        for (const arg of call.arguments) {
+            const names = arg.variable
+                ? [arg.variable]
+                : (arg.expression ?? '').match(/[A-Za-z_]\w*/g) ?? [];
+            if (names.some(n => constPropTaints(constProp, method, n)))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Does the callee `return` a variable const-prop holds tainted elements or keys
+ * for (`vars[i] = "X=" + param; return vars;`)? Const-prop does not carry that
+ * into the call's result, so its "clean" assignee is not proof here.
+ */
+function calleeReturnsTaintedContainer(constProp, code, startLine, endLine) {
+    const lines = code.split('\n');
+    for (let l = startLine; l <= endLine; l++) {
+        const m = /^\s*return\s+([A-Za-z_]\w*)\s*;/.exec(lines[l - 1] ?? '');
+        if (!m)
+            continue;
+        if ((constProp.taintedArrayElements.get(m[1])?.size ?? 0) > 0)
+            return true;
+        if ((constProp.taintedCollections.get(m[1])?.size ?? 0) > 0)
+            return true;
+    }
+    return false;
+}
+/**
+ * Sink types whose parameter-sourced helper flows are dropped when the
+ * parameter reaches the helper's return only through a constant-dead branch
+ * (`if ((7 * 42) - num > 200) bar = "safe"; else bar = param;`).
+ */
+const DEAD_BRANCH_CHECKED_SINKS = new Set([
+    'sql_injection', 'trust_boundary', 'path_traversal', 'ldap_injection', 'xpath_injection',
+]);
+/**
+ * Java: do the defs a callee source creates reach a `return` of the callee?
+ * Follows def-use chains forward (a use of a reached def reaches the locals
+ * defined on its line), so an overwrite before the return ends the chain.
+ * A source on the return line itself reaches it.
+ */
+function calleeSourceReachesReturn(graph, code, startLine, endLine, sourceLine) {
+    const lines = code.split('\n');
+    const returnLines = new Set();
+    for (let l = startLine; l <= endLine; l++) {
+        if (/^\s*return\b/.test(lines[l - 1] ?? ''))
+            returnLines.add(l);
+    }
+    if (returnLines.size === 0)
+        return true; // nothing to prove against: keep the source
+    if (returnLines.has(sourceLine))
+        return true;
+    const inRange = (l) => l >= startLine && l <= endLine;
+    // A statement can span lines (`String e =\n new String(\n … d.getBytes()));`):
+    // the def sits on its first line, the uses on later ones.
+    const ends = (l) => /[;{}]\s*$/.test((lines[l - 1] ?? '').replace(/\/\/.*$/, '').trimEnd());
+    const statementStart = (l) => {
+        let s = l;
+        while (s > startLine && !ends(s - 1) && (lines[s - 2] ?? '').trim() !== '')
+            s--;
+        return s;
+    };
+    const reached = new Set(graph.ir.dfg.defs.filter(d => d.line === sourceLine && d.kind === 'local').map(d => d.id));
+    if (reached.size === 0)
+        return true; // the source defines nothing we can follow
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const u of graph.ir.dfg.uses) {
+            if (u.def_id === null || !reached.has(u.def_id) || !inRange(u.line))
+                continue;
+            const stmt = statementStart(u.line);
+            if (returnLines.has(u.line) || returnLines.has(stmt))
+                return true;
+            for (const d of graph.ir.dfg.defs) {
+                if ((d.line === u.line || d.line === stmt) && d.kind === 'local' && !reached.has(d.id)) {
+                    reached.add(d.id);
+                    changed = true;
+                }
+            }
+            // An element or field store (`arr[i] = name + "=" + value;`, `o.f = value;`)
+            // defines no local, but the value now lives in the base: follow the base's
+            // def (plexus-utils `getEnvironmentVariables()` fills an array it returns).
+            // Container calls (`map.put`, `list.add`) are not followed: the keyed
+            // overwrite cases above depend on them ending the chain.
+            const base = storeBase(lines[stmt - 1] ?? '');
+            if (base && base !== u.variable) {
+                for (const b of graph.ir.dfg.uses) {
+                    if ((b.line === u.line || b.line === stmt) && b.variable === base &&
+                        b.def_id !== null && !reached.has(b.def_id)) {
+                        reached.add(b.def_id);
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+    return false;
+}
+/** `arr[i] = …` / `arr[i][j] = …` / `obj.field = …` → the base local's name; else null. */
+function storeBase(line) {
+    const m = /^\s*([A-Za-z_]\w*)\s*(?:\[[^\]=]*\]\s*)+=(?!=)/.exec(line) ??
+        /^\s*([A-Za-z_]\w*)\s*\.\s*[A-Za-z_]\w*\s*=(?!=)/.exec(line);
+    if (!m || m[1] === 'this')
+        return null;
+    return m[1];
+}
+/** cognium-dev#590 — connect a source inside a callee to a sink in the caller. */
+function appendCalleeSourceCallerSinkFlows(graph, sources, sinks, interProc, additionalFlows, fileCode, constProp) {
+    const types = graph.ir.types ?? [];
+    for (const edge of interProc.callEdges) {
+        const callee = interProc.methodNodes.get(edge.calleeMethod);
+        if (!callee)
+            continue;
+        // Java: a source the callee overwrites before it returns
+        // (`bar = map.get("keyB"); bar = map.get("keyA"); return bar;`) does not
+        // reach the caller. Parameters are kept here; their live reach is the
+        // dead-branch check below.
+        const calleeSources = sources.filter(s => s.line >= callee.startLine && s.line <= callee.endLine &&
+            (!fileCode || s.type === 'interprocedural_param' ||
+                calleeSourceReachesReturn(graph, fileCode, callee.startLine, callee.endLine, s.line)));
+        if (calleeSources.length === 0)
+            continue;
+        const assignee = graph.ir.dfg.defs.find(d => d.line === edge.callLine && d.kind === 'local');
+        if (!assignee?.variable)
+            continue;
+        // A source inside the callee taints the caller only through the value the
+        // callee returns. Constant propagation evaluates that return with the
+        // callee's arguments (map keys, list indexes, constant branches, switch
+        // arms), and the DFG flows it vetoes are not reported either. When it has
+        // the assignee as a tracked, untainted value, the callee's source does not
+        // reach the return (OWASP `doSomething` helpers: `map.get("keyA")` after a
+        // `map.get("keyB")`, `if ((7 * 42) - num > 200)`, `valuesList.get(1)`).
+        // Its verdict is informed only when it saw tainted data go into the call:
+        // a value from another file (`scr.getTheParameter(…)`) is not a source to
+        // it, and then "clean" means "never tainted here", not "the callee drops it".
+        if (constProp &&
+            callArgumentIsConstPropTainted(graph, constProp, edge.callerMethod, edge.callLine) &&
+            assigneeIsConstPropClean(constProp, edge.callerMethod, assignee.variable) &&
+            !(fileCode && calleeReturnsTaintedContainer(constProp, fileCode, callee.startLine, callee.endLine))) {
+            continue;
+        }
+        const derivedLocals = localsDerivedFromAssignee(graph, assignee.variable, assignee.line);
+        for (const sink of sinks) {
+            if (sink.type === 'external_taint_escape')
+                continue;
+            if (sink.line <= edge.callLine)
+                continue;
+            if (enclosingMethodName(types, sink.line) !== edge.callerMethod)
+                continue;
+            const sinkVar = sinkVariableConsumingDerived(graph, sink, derivedLocals);
+            if (!sinkVar)
+                continue;
+            if (additionalFlows.some(f => f.source_line === calleeSources[0].line && f.sink_line === sink.line)) {
+                continue;
+            }
+            const source = calleeSources[0];
+            if (fileCode &&
+                source.type === 'interprocedural_param' &&
+                source.variable &&
+                DEAD_BRANCH_CHECKED_SINKS.has(sink.type) &&
+                interproceduralParamReachIsDeadBranchOnly(fileCode, callee.startLine, callee.endLine, source.variable, assignee.variable)) {
+                continue;
+            }
+            // cognium-dev#913 / #914 / #916 / #917 — the helper's return value cannot
+            // carry any of its parameters on a live path (constant / literal-slot /
+            // folded-ternary returns). Every source inside the callee must be a
+            // parameter source, and none may reach the return: a helper taking
+            // `(request, param)` is judged on both, and a real source inside the
+            // callee is never gated here.
+            if (fileCode &&
+                HELPER_RETURN_GATED_SINKS.has(sink.type) &&
+                calleeSources.every(s => (s.type === 'interprocedural_param' || s.type === 'plugin_param') && !!s.variable) &&
+                !calleeReturnMayCarryParam(fileCode, callee.startLine, callee.endLine, calleeSources.map(s => s.variable))) {
+                continue;
+            }
+            additionalFlows.push({
+                source_line: source.line,
+                sink_line: sink.line,
+                source_type: source.type,
+                sink_type: sink.type,
+                path: [
+                    { variable: source.location, line: source.line, type: 'source' },
+                    { variable: assignee.variable, line: edge.callLine, type: 'use' },
+                    { variable: sinkVar, line: sink.line, type: 'sink' },
+                ],
+                confidence: sink.confidence * source.confidence * 0.85,
+                sanitized: false,
+            });
+        }
+    }
+}
+/**
+ * True when `param` would taint `local` only if dead-branch lines are counted
+ * (e.g. OWASP #913 `else bar = param`), not when live propagation also reaches
+ * `local` (list/Base64 helpers — cognium-dev#913 round 2).
+ */
+function interproceduralParamReachIsDeadBranchOnly(code, startLine, endLine, paramName, localName) {
+    if (paramName === localName)
+        return false;
+    const lines = code.split('\n');
+    const slice = lines.slice(startLine - 1, endLine);
+    const sliceText = slice.join('\n');
+    const dead = computeDeadJavaBranchLines(slice);
+    const onLivePaths = buildJavaTaintedVars(sliceText, new Set([paramName]), dead);
+    const ifDeadLinesCount = buildJavaTaintedVars(sliceText, new Set([paramName]), new Set());
+    return ifDeadLinesCount.has(localName) && !onLivePaths.has(localName);
+}
+/** Sink types whose caller-side flow is dropped when the helper cannot return the parameter. */
+const HELPER_RETURN_GATED_SINKS = new Set([
+    'sql_injection',
+    'trust_boundary',
+    'command_injection',
+    'path_traversal',
+    // #976: the same helper shapes feed LDAP and XPath sinks (OWASP ldapi/xpathi).
+    'ldap_injection',
+    'xpath_injection',
+]);
+/**
+ * Can the callee's return value carry any of `sourceVars` (or a declared
+ * parameter) on a live path?
+ * cognium-dev#913 / #914 / #916 / #917.
+ *
+ * Conservative: answers false (gate the flow) only when every `return` on a live
+ * path is understood and none can carry the parameter. A return expression that
+ * mentions the parameter or anything derived from it, or a callee with no
+ * readable `return`, answers true.
+ * Derivation uses `buildJavaTaintedVars` with slot tracking, so `list.get(1)`
+ * after `list.remove(0)`, `map.get("<literal key>")` and a ternary whose
+ * condition folds to a constant pick the value actually returned.
+ */
+export function calleeReturnMayCarryParam(code, startLine, endLine, sourceVars) {
+    const raw = code.split('\n').slice(startLine - 1, endLine);
+    // Seed with the helper's declared parameters as well as the sources found in
+    // it: a `plugin_param` on `bar = (String) map.get("keyB")` stands for the
+    // parameter stored under that key, which the slot tables resolve.
+    const paramNames = [...sourceVars, ...javaMethodParamNames(raw)];
+    const dead = computeDeadJavaBranchLines(raw);
+    const inlined = new Set();
+    const slice = joinWrappedStatements(raw, inlined);
+    // The tracker follows assignments. A receiver mutated by a call with a carried
+    // argument (`sb.append(param)`, `parts.addAll(list)`) carries it too, so it is
+    // added as a seed and the tracker re-run until nothing new is reached.
+    const text = slice.join('\n');
+    const seeds = new Set(paramNames);
+    // Receivers that carry a value only because they were mutated with it: their
+    // declaration (`new String[n]`, `new StringBuilder()`) never does.
+    const mutated = new Set();
+    let live = new Set(seeds);
+    for (let round = 0; round < 8; round++) {
+        live = new Set([...seeds, ...buildJavaTaintedVars(text, seeds, dead, { trackSlots: true }).keys()]);
+        let grew = false;
+        for (let i = 0; i < slice.length; i++) {
+            if (dead.has(i))
+                continue;
+            for (const call of slice[i].matchAll(/([A-Za-z_]\w*)\s*\.\s*[A-Za-z_]\w*\s*\(([^;]*)\)/g)) {
+                if (live.has(call[1]))
+                    continue;
+                const args = call[2].replace(/"(?:[^"\\]|\\.)*"/g, ' ').match(/[\p{L}\p{N}_]+/gu) ?? [];
+                if (args.some(t => live.has(t))) {
+                    seeds.add(call[1]);
+                    mutated.add(call[1]);
+                    grew = true;
+                }
+            }
+            // An element or field store (`vars[i] = name + "=" + value;`, `o.f = value;`)
+            // carries the value into its base (plexus-utils getEnvironmentVariables()).
+            const store = /^\s*([A-Za-z_]\w*)\s*(?:(?:\[[^\]=]*\]\s*)+|\.\s*[A-Za-z_]\w*\s*)=(?!=)\s*(.*?);?\s*$/.exec(slice[i]);
+            if (store && store[1] !== 'this' && !live.has(store[1])) {
+                const rhs = store[2].replace(/"(?:[^"\\]|\\.)*"/g, ' ').match(/[\p{L}\p{N}_]+/gu) ?? [];
+                if (rhs.some(t => live.has(t))) {
+                    seeds.add(store[1]);
+                    mutated.add(store[1]);
+                    grew = true;
+                }
+            }
+        }
+        if (!grew)
+            break;
+    }
+    let sawReturn = false;
+    for (let i = 0; i < slice.length; i++) {
+        if (dead.has(i) || !/^\s*return\b/.test(slice[i]))
+            continue;
+        const m = /^\s*return\b\s*(.*?)\s*;\s*(?:\/\/.*)?$/.exec(slice[i]);
+        if (!m)
+            return true; // could not read this return
+        sawReturn = true;
+        const expr = m[1];
+        const bare = /^[A-Za-z_]\w*$/.test(expr) ? expr : null;
+        if (bare && mutated.has(bare))
+            return true;
+        if (bare && live.has(bare)) {
+            // The tracker is flow-insensitive: `bar = map.get("tainted-key"); bar =
+            // map.get("safe-key"); return bar;` reaches it either way. Judge the
+            // assignment that actually reaches this return instead, when there is one.
+            const def = mustReachingAssignment(slice, dead, i, bare, inlined);
+            if (!def)
+                return true;
+            const upTo = slice.slice(0, def.line);
+            upTo.push(`__helperReturn = ${def.rhs};`);
+            const atDef = buildJavaTaintedVars(upTo.join('\n'), seeds, dead, { trackSlots: true });
+            if (atDef.has('__helperReturn'))
+                return true;
+            continue;
+        }
+        const idents = (expr.replace(/"(?:[^"\\]|\\.)*"/g, ' ').replace(/'(?:[^'\\]|\\.)'/g, ' ').match(/[\p{L}\p{N}_]+/gu) ?? []);
+        if (idents.some(t => live.has(t)))
+            return true;
+    }
+    return !sawReturn;
+}
+/** Parameter names from a Java method header (the lines before its body's `{`). */
+function javaMethodParamNames(lines) {
+    const header = lines.join('\n').split('{')[0];
+    const open = header.indexOf('(');
+    if (open < 0)
+        return [];
+    let depth = 0;
+    let end = -1;
+    for (let k = open; k < header.length; k++) {
+        if (header[k] === '(')
+            depth++;
+        else if (header[k] === ')' && --depth === 0) {
+            end = k;
+            break;
+        }
+    }
+    if (end < 0)
+        return [];
+    const names = [];
+    let angle = 0;
+    let piece = '';
+    for (const c of header.slice(open + 1, end) + ',') {
+        if (c === '<')
+            angle++;
+        else if (c === '>')
+            angle--;
+        if (c === ',' && angle === 0) {
+            const m = /([A-Za-z_]\w*)\s*(?:\[\s*\])*\s*$/.exec(piece.trim());
+            if (m)
+                names.push(m[1]);
+            piece = '';
+        }
+        else
+            piece += c;
+    }
+    return names;
+}
+/**
+ * Join each statement that wraps over several lines onto its first line and
+ * leave the continuation lines blank, so line indices (and dead-branch lines)
+ * still line up: `bar =\n  new String(\n    param.getBytes());` reads as one
+ * assignment. Control-flow headers (`if (x)` with the statement on the next
+ * line) and annotations are left as they are, as are comment lines.
+ */
+function joinWrappedStatements(lines, inlined) {
+    const out = [...lines];
+    const ends = /[;{}:]\s*(?:\/\/.*)?$/;
+    const header = /^\s*(?:if|else|for|while|do|switch|case|default|try|catch|finally|synchronized)\b|^\s*@|^\s*(?:\/\/|\/?\*)/;
+    for (let i = 0; i < out.length; i++) {
+        const line = out[i];
+        if (line.trim() === '' || ends.test(line) || header.test(line))
+            continue;
+        let joined = line;
+        let j = i + 1;
+        for (; j < out.length && j < i + 15; j++) {
+            joined += ' ' + out[j].trim();
+            if (ends.test(out[j]))
+                break;
+        }
+        if (j >= out.length || j >= i + 15)
+            continue; // never terminated: leave it alone
+        out[i] = joined;
+        for (let k = i + 1; k <= j; k++)
+            out[k] = '';
+        i = j;
+    }
+    return out.map((line, i) => {
+        const body = inlineControlBody(line);
+        if (body !== line)
+            inlined.add(i);
+        return body;
+    });
+}
+/**
+ * `if (c) bar = param;` → `bar = param;` (also `else …`, `else if (c) …`,
+ * `for (…) …`, `while (…) …`). The tracker anchors assignments at the start of
+ * the line, so a one-line branch body was invisible to it. Dead branches were
+ * already computed on the original lines, so only the reading changes.
+ */
+function inlineControlBody(line) {
+    let rest = line;
+    const indent = /^\s*/.exec(line)[0];
+    for (let guard = 0; guard < 4; guard++) {
+        const t = rest.trimStart();
+        const elseM = /^(?:\}\s*)?else\b\s*/.exec(t);
+        if (elseM && !/^(?:\}\s*)?else\s+if\b/.test(t)) {
+            rest = t.slice(elseM[0].length);
+            continue;
+        }
+        const head = /^(?:\}\s*)?(?:else\s+)?(?:if|for|while)\s*\(/.exec(t);
+        if (!head)
+            break;
+        // Skip the balanced condition.
+        let depth = 1;
+        let k = head[0].length;
+        for (; k < t.length && depth > 0; k++) {
+            if (t[k] === '(')
+                depth++;
+            else if (t[k] === ')')
+                depth--;
+        }
+        if (depth !== 0)
+            return line;
+        rest = t.slice(k);
+    }
+    const body = rest.trim();
+    if (body === '' || body === rest.trim() && body === line.trim() || body.startsWith('{'))
+        return line;
+    return indent + body;
+}
+/**
+ * The assignment to `name` that must reach the `return` on slice line `retLine`:
+ * the closest preceding single-line `name = …;` in the same block, with no
+ * assignment to `name` in a nested block after it and no exit from the block in
+ * between. `null` when there is no such assignment (the caller then stays
+ * conservative).
+ */
+function mustReachingAssignment(slice, dead, retLine, name, 
+/** lines that were a one-line branch body: an assignment there is conditional */
+inlined) {
+    // Brace depth at the start of each line, string and char literals skipped.
+    const depth = [];
+    let d = 0;
+    for (const line of slice) {
+        depth.push(d);
+        const code = line.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''").replace(/\/\/.*$/, '');
+        for (const c of code) {
+            if (c === '{')
+                d++;
+            else if (c === '}')
+                d--;
+        }
+    }
+    const target = depth[retLine];
+    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const assign = new RegExp(`^\\s*(?:(?:final\\s+)?[A-Za-z_][\\w.]*(?:\\s*<[^>]*>)?(?:\\s*\\[\\s*\\])*\\s+)?${esc}\\s*=\\s*(.+?);\\s*(?://.*)?$`);
+    const mentionsAssign = new RegExp(`(?<![\\w.])${esc}\\s*=(?!=)`);
+    for (let j = retLine - 1; j >= 0; j--) {
+        if (depth[j] < target)
+            return null; // left the return's block
+        if (dead.has(j))
+            continue;
+        if (!mentionsAssign.test(slice[j]))
+            continue;
+        if (depth[j] > target || inlined.has(j))
+            return null; // a conditional reassignment
+        const m = assign.exec(slice[j]);
+        if (!m)
+            return null; // wrapped or compound assignment
+        return { line: j, rhs: m[1] };
+    }
+    return null;
+}
+/** DFG-forward names reachable from a helper-return assignment LHS (same file). */
+function localsDerivedFromAssignee(graph, seedVar, seedLine) {
+    const defs = graph.ir.dfg.defs;
+    const chains = graph.ir.dfg.chains ?? [];
+    const seedDefs = defs.filter(d => d.variable === seedVar && d.line === seedLine && d.kind === 'local');
+    if (seedDefs.length === 0)
+        return new Set([seedVar]);
+    const defIds = new Set(seedDefs.map(d => d.id));
+    const frontier = seedDefs.map(d => d.id);
+    const visited = new Set(frontier);
+    while (frontier.length > 0) {
+        const cur = frontier.shift();
+        for (const ch of chains) {
+            if (ch.from_def !== cur || visited.has(ch.to_def))
+                continue;
+            visited.add(ch.to_def);
+            defIds.add(ch.to_def);
+            frontier.push(ch.to_def);
+        }
+    }
+    const names = new Set([seedVar]);
+    for (const d of defs) {
+        if (d.variable && defIds.has(d.id))
+            names.add(d.variable);
+    }
+    return names;
+}
+function sinkVariableConsumingDerived(graph, sink, derived) {
+    for (const u of graph.usesAtLine(sink.line)) {
+        if (u.variable && derived.has(u.variable))
+            return u.variable;
+    }
+    for (const call of graph.callsByLine.get(sink.line) ?? []) {
+        for (const arg of call.arguments ?? []) {
+            if (arg.variable && derived.has(arg.variable))
+                return arg.variable;
+            if (arg.expression) {
+                for (const v of derived) {
+                    const re = new RegExp(`\\b${v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
+                    if (re.test(arg.expression))
+                        return v;
+                }
+            }
+        }
+    }
+    return undefined;
+}
+function enclosingMethodName(types, line) {
+    for (const type of types) {
+        for (const method of type.methods) {
+            if (line >= method.start_line && line <= method.end_line) {
+                return method.name;
+            }
+        }
+    }
+    return null;
+}
 export function csharpParamReachesSink(code, method, taintedArgs, sink, credit) {
     // CRLF files leave `\r` on every line, which `.` and `$` will not cross.
     const lines = code.split(/\r?\n/);