circle-ir 4.9.12 → 4.9.13

package/dist/browser/circle-ir.js

@@ -9363,6 +9363,7 @@ function buildCSharpDFG(tree, cache) {
   ];
   for (const method of methods) {
     scopeStack.push(/* @__PURE__ */ new Map());
+    const methodDefStart = defs.length;
     const params = method.childForFieldName("parameters");
     if (params) {
       for (const def of extractParameterDefs(params, defIdCounter)) {
@@ -9392,6 +9393,7 @@ function buildCSharpDFG(tree, cache) {
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
     }
@@ -10101,6 +10103,30 @@ function findReachingDef(name2, scopeStack) {
   }
   return null;
 }
+function resolveReassignedUses(methodDefs, methodUses) {
+  const defsByVar = /* @__PURE__ */ new Map();
+  for (const def of methodDefs) {
+    if (def.kind !== "local" && def.kind !== "param") continue;
+    const existing = defsByVar.get(def.variable);
+    if (existing) existing.push(def);
+    else defsByVar.set(def.variable, [def]);
+  }
+  for (const list of defsByVar.values()) {
+    if (list.length > 1) list.sort((a, b) => a.line - b.line || a.id - b.id);
+  }
+  for (const use of methodUses) {
+    const list = defsByVar.get(use.variable);
+    if (!list || list.length < 2) continue;
+    let strictlyBefore;
+    let sameLine;
+    for (const def of list) {
+      if (def.line < use.line) strictlyBefore = def;
+      else if (def.line === use.line) sameLine = def;
+    }
+    const reaching = strictlyBefore ?? sameLine;
+    if (reaching) use.def_id = reaching.id;
+  }
+}
 function computeChains(defs, uses) {
   const chains = [];
   const defById = /* @__PURE__ */ new Map();
@@ -18965,7 +18991,7 @@ function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
 function buildTaintFlow(source, sink, taintInfo) {
   const path = [];
   path.push({
-    variable: taintInfo.variable,
+    variable: source.variable ?? taintInfo.variable,
     line: source.line,
     type: "source",
     description: `Tainted data enters via ${source.type}`
@@ -27163,6 +27189,7 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(...findPythonUrlAllowlistRedirectSanitizers(code));
       additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
       additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
+      additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, "python"));
       const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
       for (const finding of pyMisconfigFindings) {
         ctx.addFinding(finding);
@@ -27321,6 +27348,11 @@ var LanguageSourcesPass = class {
         ctx.addFinding(finding);
       }
     }
+    if (language === "csharp") {
+      additionalSanitizers.push(
+        ...findCSharpFullPathStartsWithGuardSanitizers(code)
+      );
+    }
     if (language === "java") {
       additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
       additionalSanitizers.push(
@@ -27329,6 +27361,7 @@ var LanguageSourcesPass = class {
       additionalSanitizers.push(...findJavaPathGetFileNameSanitizers(code));
       additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
       additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
+      additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, "java"));
       additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
       for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
         ctx.addFinding(finding);
@@ -29896,7 +29929,7 @@ function findJsPathResolveStartsWithGuardSanitizers(code) {
     let guardLine = -1;
     for (let l = c.line; l < Math.min(lines.length, c.line + 6); l++) {
       if (!guardRe.test(lines[l])) continue;
-      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+      if (guardRejects(lines, l, terminatorRe, 2)) {
         guardLine = l + 1;
         break;
       }
@@ -30005,7 +30038,7 @@ function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
     let guardLine = -1;
     for (let l = c.line; l < Math.min(lines.length, c.line + 6); l++) {
       if (!guardRe.test(lines[l])) continue;
-      if (terminatorRe.test(lines[l]) || l + 1 < lines.length && terminatorRe.test(lines[l + 1])) {
+      if (guardRejects(lines, l, terminatorRe, 2)) {
         guardLine = l + 1;
         break;
       }
@@ -30039,17 +30072,7 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
   for (let i2 = 0; i2 < lines.length; i2++) {
     const m = guardRe.exec(lines[i2]);
     if (!m) continue;
-    let hasTerminator = terminatorRe.test(lines[i2]);
-    if (!hasTerminator) {
-      for (let j = i2 + 1; j < Math.min(lines.length, i2 + 6); j++) {
-        if (terminatorRe.test(lines[j])) {
-          hasTerminator = true;
-          break;
-        }
-        if (lines[j].includes("}")) break;
-      }
-    }
-    if (!hasTerminator) continue;
+    if (!guardRejects(lines, i2, terminatorRe, 6)) continue;
     const guarded = /* @__PURE__ */ new Set([m[1]]);
     const mentions = (t) => {
       for (const n of guarded) if (new RegExp(`\\b${n}\\b`).test(t)) return true;
@@ -30074,6 +30097,58 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function guardRejects(lines, i2, terminatorRe, window2) {
+  if (terminatorRe.test(lines[i2])) return true;
+  const opens = (lines[i2].match(/\{/g) ?? []).length;
+  const closes = (lines[i2].match(/\}/g) ?? []).length;
+  if (opens > 0 && closes >= opens) return false;
+  for (let j = i2 + 1; j < Math.min(lines.length, i2 + window2); j++) {
+    if (terminatorRe.test(lines[j])) return true;
+    if (lines[j].includes("}")) return false;
+  }
+  return false;
+}
+function findCSharpFullPathStartsWithGuardSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const assignRe = /^\s*(?:(?:var|string)\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.*)$/;
+  const fullPathRe = /\bPath\s*\.\s*GetFullPath\s*\(/;
+  const canonicalVars = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    const a = assignRe.exec(line);
+    if (a && fullPathRe.test(a[2])) canonicalVars.add(a[1]);
+  }
+  if (canonicalVars.size === 0) return sanitizers;
+  const guardRe = /\bif\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*StartsWith\s*\(/;
+  const terminatorRe = /\b(throw|return)\b/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = guardRe.exec(lines[i2]);
+    if (!m || !canonicalVars.has(m[1])) continue;
+    if (!guardRejects(lines, i2, terminatorRe, 6)) continue;
+    const guarded = /* @__PURE__ */ new Set([m[1]]);
+    const mentions = (t) => {
+      for (const n of guarded) if (new RegExp(`\\b${n}\\b`).test(t)) return true;
+      return false;
+    };
+    for (let l = 0; l < lines.length; l++) {
+      const lt = lines[l];
+      const a = assignRe.exec(lt);
+      if (a) {
+        if (mentions(a[2])) guarded.add(a[1]);
+        else if (a[1] !== m[1]) guarded.delete(a[1]);
+      }
+      if (mentions(lt)) {
+        sanitizers.push({
+          type: "csharp_fullpath_startswith_guard",
+          method: "GetFullPath",
+          line: l + 1,
+          sanitizes: ["path_traversal", "external_taint_escape"]
+        });
+      }
+    }
+  }
+  return sanitizers;
+}
 function findJavaPathGetFileNameSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -30112,6 +30187,34 @@ function findJavaPathGetFileNameSanitizers(code) {
   }
   return sanitizers;
 }
+function findCrlfWrapperFunctionSanitizers(code, language) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const declRe = language === "java" ? /^\s*(?:public|private|protected)?\s*(?:static\s+)?(?:final\s+)?(?:String|CharSequence)\s+([A-Za-z_]\w*)\s*\(/ : /^\s*def\s+([A-Za-z_]\w*)\s*\(/;
+  const stripRe = language === "java" ? /\.\s*replace(?:All)?\s*\(\s*(?:"[^"]*\\[rnt]|'\\[rnt]')/ : /(?:re\s*\.\s*sub\s*\(\s*r?["'][^"']*\\[rnt]|\.\s*replace\s*\(\s*["']\\[rnt])/;
+  const bodyWindow = 10;
+  const wrappers = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = declRe.exec(lines[i2]);
+    if (!m) continue;
+    const body2 = lines.slice(i2, Math.min(lines.length, i2 + bodyWindow)).join("\n");
+    if (stripRe.test(body2)) wrappers.add(m[1]);
+  }
+  if (wrappers.size === 0) return sanitizers;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    for (const name2 of wrappers) {
+      if (declRe.test(lines[i2]) && new RegExp(`\\b${name2}\\s*\\(`).test(lines[i2])) continue;
+      if (!new RegExp(`\\b${name2}\\s*\\(`).test(lines[i2])) continue;
+      sanitizers.push({
+        type: language === "java" ? "java_wrapper_crlf_strip" : "python_wrapper_crlf_strip",
+        method: name2,
+        line: i2 + 1,
+        sanitizes: ["log_injection", "external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
 function findJavaInlineCrlfStripLogSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -33924,10 +34027,18 @@ function jsSsrfHostGuardedLines(code) {
   }
   return covered;
 }
+var CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
 var CSHARP_SANITIZER_RES = [
   { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
   { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: "xss" },
-  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" }
+  { re: /\bPath\s*\.\s*GetFileName\s*\(/, type: "path_traversal" },
+  // An allowlist strip leaves only inert characters, so it covers every family
+  // whose exploitation needs a metacharacter. Each has a fixture; see
+  // `issue-272-csharp-allowlist-strip.test.ts`.
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "ldap_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "xpath_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "command_injection" },
+  { re: CSHARP_ALLOWLIST_STRIP_RE, type: "sql_injection" }
 ];
 function csharpSanitizedVarsByType(code) {
   const lines = code.split("\n");
@@ -34746,6 +34857,36 @@ var SinkFilterPass = class {
         return true;
       });
     }
+    if (language === "csharp") {
+      const sourceLines = ctx.code.split("\n");
+      const constBaseClients = /* @__PURE__ */ new Set();
+      const declRe = /\b(?:var|HttpClient)\s+([A-Za-z_]\w*)\s*=\s*new\s+HttpClient\s*\{[^}]*\bBaseAddress\s*=\s*new\s+Uri\s*\(\s*(?:@?"[^"]*"|\$?"[^"{}]*")\s*\)/;
+      for (const line of sourceLines) {
+        const m = declRe.exec(line);
+        if (m) constBaseClients.add(m[1]);
+      }
+      if (constBaseClients.size > 0) {
+        const relativeLiteralArgRe = /\.\s*(?:Get|Post|Put|Patch|Delete|Send|GetString|GetByteArray|GetStream)\w*Async\s*\(\s*(?:@?\$?)"([^"]*)"/;
+        filtered = filtered.filter((sink) => {
+          if (sink.type !== "ssrf") return true;
+          const text = sourceLines[sink.line - 1] ?? "";
+          let onConstClient = false;
+          for (const v of constBaseClients) {
+            if (new RegExp(`(?<![\\w])${escapeRegex(v)}\\s*\\.`).test(text)) {
+              onConstClient = true;
+              break;
+            }
+          }
+          if (!onConstClient) return true;
+          const m = relativeLiteralArgRe.exec(text);
+          if (!m) return true;
+          const lit = m[1];
+          if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(lit)) return true;
+          if (lit.startsWith("//")) return true;
+          return false;
+        });
+      }
+    }
     if (["javascript", "typescript"].includes(language)) {
       const sourceLines = ctx.code.split("\n");
       filtered = filtered.filter((sink) => {
@@ -40575,6 +40716,18 @@ var CRYPTO_BLOCKING_METHODS = /* @__PURE__ */ new Set([
   "deriveKeySync"
 ]);
 var SYNC_SUFFIX_RE2 = /Sync$/;
+var ROUTER_METHODS = /* @__PURE__ */ new Set([
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "all",
+  "options",
+  "head",
+  "use"
+]);
+var FN_ARG_PARAMS_RE = /^(?:async\s+)?(?:function\s*[\w$]*\s*)?\(([^)]*)\)\s*(?:=>|\{)|^(?:async\s+)?([A-Za-z_$][\w$]*)\s*=>/;
 var BlockingMainThreadPass = class {
   name = "blocking-main-thread";
   category = "performance";
@@ -40596,7 +40749,10 @@ var BlockingMainThreadPass = class {
         }
       }
     }
-    if (handlerRanges.length === 0) return { blockingInHandlers: [] };
+    const inlineHandlers = this.collectInlineHandlerNames(graph.ir.calls);
+    if (handlerRanges.length === 0 && inlineHandlers.size === 0) {
+      return { blockingInHandlers: [] };
+    }
     const blockingInHandlers = [];
     for (const call of graph.ir.calls) {
       const name2 = call.method_name;
@@ -40604,7 +40760,8 @@ var BlockingMainThreadPass = class {
       const isSyncSuffix = SYNC_SUFFIX_RE2.test(name2);
       if (!isCrypto && !isSyncSuffix) continue;
       const line = call.location.line;
-      const range = handlerRanges.find((r) => line >= r.start && line <= r.end);
+      const enclosing = call.in_method ?? null;
+      const range = handlerRanges.find((r) => line >= r.start && line <= r.end) ?? (enclosing && inlineHandlers.has(enclosing) ? { start: line, end: line, name: enclosing } : void 0);
       if (!range) continue;
       const reason = isCrypto ? "crypto" : "sync-suffix";
       blockingInHandlers.push({ line, method: name2, handler: range.name, reason });
@@ -40625,6 +40782,40 @@ var BlockingMainThreadPass = class {
     }
     return { blockingInHandlers };
   }
+  /**
+   * Synthetic `<verb>_handler` names that really do belong to an HTTP route.
+   *
+   * The extractor tags *any* function argument of *any* member-expression call
+   * this way, so `items.map(x => …)` becomes `map_handler` and
+   * `cache.get(k, () => …)` becomes `get_handler`. Accepting every
+   * `*_handler` would pull ordinary callbacks into a pass that is explicitly
+   * about the HTTP request path, so two conditions are required: the method is
+   * a router verb, and the callback's own parameters look like a request
+   * handler's — the same `HANDLER_PARAM_NAMES` test used for methods.
+   *
+   * Known limitation: `in_method` carries no receiver, so two callbacks that
+   * share a verb in one file are indistinguishable. A file containing both
+   * `app.get('/x', (req, res) => …)` and `cache.get(k, () => …)` will treat a
+   * blocking call in the second as in-handler. Both conditions still have to
+   * hold for the verb to register at all, which keeps that to files already
+   * mounting a real route of the same verb.
+   */
+  collectInlineHandlerNames(calls) {
+    const names = /* @__PURE__ */ new Set();
+    for (const call of calls) {
+      if (!ROUTER_METHODS.has(call.method_name)) continue;
+      for (const arg of call.arguments) {
+        const match = FN_ARG_PARAMS_RE.exec((arg.expression ?? "").trim());
+        if (!match) continue;
+        const params = (match[1] ?? match[2] ?? "").split(",").map((p) => p.trim().toLowerCase()).filter((p) => p.length > 0);
+        if (params.some((p) => HANDLER_PARAM_NAMES.has(p))) {
+          names.add(`${call.method_name}_handler`);
+          break;
+        }
+      }
+    }
+    return names;
+  }
   isRequestHandler(method) {
     if (method.annotations.some((a) => HTTP_DECORATORS.has(a))) return true;
     if (HANDLER_METHOD_NAMES.has(method.name)) return true;

package/dist/core/circle-ir-core.cjs

@@ -9409,6 +9409,7 @@ function buildCSharpDFG(tree, cache) {
   ];
   for (const method of methods) {
     scopeStack.push(/* @__PURE__ */ new Map());
+    const methodDefStart = defs.length;
     const params = method.childForFieldName("parameters");
     if (params) {
       for (const def of extractParameterDefs(params, defIdCounter)) {
@@ -9438,6 +9439,7 @@ function buildCSharpDFG(tree, cache) {
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
     }
@@ -10147,6 +10149,30 @@ function findReachingDef(name2, scopeStack) {
   }
   return null;
 }
+function resolveReassignedUses(methodDefs, methodUses) {
+  const defsByVar = /* @__PURE__ */ new Map();
+  for (const def of methodDefs) {
+    if (def.kind !== "local" && def.kind !== "param") continue;
+    const existing = defsByVar.get(def.variable);
+    if (existing) existing.push(def);
+    else defsByVar.set(def.variable, [def]);
+  }
+  for (const list of defsByVar.values()) {
+    if (list.length > 1) list.sort((a, b) => a.line - b.line || a.id - b.id);
+  }
+  for (const use of methodUses) {
+    const list = defsByVar.get(use.variable);
+    if (!list || list.length < 2) continue;
+    let strictlyBefore;
+    let sameLine;
+    for (const def of list) {
+      if (def.line < use.line) strictlyBefore = def;
+      else if (def.line === use.line) sameLine = def;
+    }
+    const reaching = strictlyBefore ?? sameLine;
+    if (reaching) use.def_id = reaching.id;
+  }
+}
 function computeChains(defs, uses) {
   const chains = [];
   const defById = /* @__PURE__ */ new Map();
@@ -16930,7 +16956,7 @@ function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
 function buildTaintFlow(source, sink, taintInfo) {
   const path = [];
   path.push({
-    variable: taintInfo.variable,
+    variable: source.variable ?? taintInfo.variable,
     line: source.line,
     type: "source",
     description: `Tainted data enters via ${source.type}`

package/dist/core/circle-ir-core.js

@@ -9343,6 +9343,7 @@ function buildCSharpDFG(tree, cache) {
   ];
   for (const method of methods) {
     scopeStack.push(/* @__PURE__ */ new Map());
+    const methodDefStart = defs.length;
     const params = method.childForFieldName("parameters");
     if (params) {
       for (const def of extractParameterDefs(params, defIdCounter)) {
@@ -9372,6 +9373,7 @@ function buildCSharpDFG(tree, cache) {
         }
       }
       const bodyUses = extractUses(body2, useIdCounter, scopeStack, false);
+      resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
       uses.push(...bodyUses.uses);
       useIdCounter = bodyUses.nextId;
     }
@@ -10081,6 +10083,30 @@ function findReachingDef(name2, scopeStack) {
   }
   return null;
 }
+function resolveReassignedUses(methodDefs, methodUses) {
+  const defsByVar = /* @__PURE__ */ new Map();
+  for (const def of methodDefs) {
+    if (def.kind !== "local" && def.kind !== "param") continue;
+    const existing = defsByVar.get(def.variable);
+    if (existing) existing.push(def);
+    else defsByVar.set(def.variable, [def]);
+  }
+  for (const list of defsByVar.values()) {
+    if (list.length > 1) list.sort((a, b) => a.line - b.line || a.id - b.id);
+  }
+  for (const use of methodUses) {
+    const list = defsByVar.get(use.variable);
+    if (!list || list.length < 2) continue;
+    let strictlyBefore;
+    let sameLine;
+    for (const def of list) {
+      if (def.line < use.line) strictlyBefore = def;
+      else if (def.line === use.line) sameLine = def;
+    }
+    const reaching = strictlyBefore ?? sameLine;
+    if (reaching) use.def_id = reaching.id;
+  }
+}
 function computeChains(defs, uses) {
   const chains = [];
   const defById = /* @__PURE__ */ new Map();
@@ -16864,7 +16890,7 @@ function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
 function buildTaintFlow(source, sink, taintInfo) {
   const path = [];
   path.push({
-    variable: taintInfo.variable,
+    variable: source.variable ?? taintInfo.variable,
     line: source.line,
     type: "source",
     description: `Tainted data enters via ${source.type}`

package/dist/core/extractors/dfg.js

@@ -90,6 +90,9 @@ function buildCSharpDFG(tree, cache) {
     ];
     for (const method of methods) {
         scopeStack.push(new Map());
+        // Where this method's defs begin, so the reaching-def correction below stays
+        // inside the method — `defs` accumulates across every method in the file.
+        const methodDefStart = defs.length;
         // Parameters (kind: param).
         const params = method.childForFieldName('parameters');
         if (params) {
@@ -123,6 +126,7 @@ function buildCSharpDFG(tree, cache) {
             }
             // Uses: all identifier references, reaching defs resolved from scope.
             const bodyUses = extractUses(body, useIdCounter, scopeStack, false);
+            resolveReassignedUses(defs.slice(methodDefStart), bodyUses.uses);
             uses.push(...bodyUses.uses);
             useIdCounter = bodyUses.nextId;
         }
@@ -986,6 +990,79 @@ function findReachingDef(name, scopeStack) {
     }
     return null;
 }
+/**
+ * Point uses of a *reassigned* variable at the nearest preceding definition.
+ *
+ * `DFGUse.def_id` is specified as the reaching definition, but the C# builder
+ * collects every def in a method body before it resolves any use, so the scope
+ * map holds only the LAST def of each variable by the time uses are resolved.
+ * With one def per variable last == reaching and nothing is wrong; a reassigned
+ * variable binds every use to its final def, which breaks taint two ways
+ * (cognium-dev#287):
+ *
+ *   var v = input;   // def A
+ *   v = v + "";      // def B — the right-hand `v` resolved to B, i.e. itself
+ *   sink(v);         // resolved to B
+ *
+ * `computeChains` skips a use whose def_id is the def it is building, so the
+ * self-reference produced no A -> B chain and taint stopped at A, while the
+ * sink read B. It also emitted a *backwards* B -> A chain, because the use of
+ * `v` on def A's own line resolved to B. Net effect: `v = v.Trim()`,
+ * `v = v.Replace(...)`, `v = v + x` silently cleared taint — a false negative,
+ * which leaves no trace to notice.
+ *
+ * Deliberately narrow. A use is repointed only when its variable has more than
+ * one definition AND a strictly-preceding one exists, so single-def variables
+ * and one-line `var sb = new StringBuilder(); sb.Append(x)` shapes keep exactly
+ * the binding they have today. Same-line ties resolve to the earlier def
+ * because in `v = f(v)` the right-hand side is evaluated before the assignment.
+ *
+ * Scoped to `local` and `param` defs. Fields are excluded on purpose: they are
+ * registered after the method loop and resolving them here would newly enable
+ * cross-method field-carried taint, which is a separate feature (the
+ * `San08FieldStore` half of #287), not this correction.
+ *
+ * Call this per method, with only that method's defs, or a local in one method
+ * will bind to a same-named local in another.
+ */
+function resolveReassignedUses(methodDefs, methodUses) {
+    const defsByVar = new Map();
+    for (const def of methodDefs) {
+        if (def.kind !== 'local' && def.kind !== 'param')
+            continue;
+        const existing = defsByVar.get(def.variable);
+        if (existing)
+            existing.push(def);
+        else
+            defsByVar.set(def.variable, [def]);
+    }
+    for (const list of defsByVar.values()) {
+        if (list.length > 1)
+            list.sort((a, b) => a.line - b.line || a.id - b.id);
+    }
+    for (const use of methodUses) {
+        const list = defsByVar.get(use.variable);
+        if (!list || list.length < 2)
+            continue; // not reassigned — leave untouched
+        // Prefer the last def strictly before this use: in `v = f(v)` the
+        // right-hand side is evaluated before the assignment, so the read sees the
+        // previous value. Falling back to a def on the use's own line keeps the
+        // declaration site (`var v = input`) bound to itself instead of to a later
+        // reassignment — that mis-binding is what emitted a *backwards* chain from
+        // the second def to the first.
+        let strictlyBefore;
+        let sameLine;
+        for (const def of list) {
+            if (def.line < use.line)
+                strictlyBefore = def;
+            else if (def.line === use.line)
+                sameLine = def;
+        }
+        const reaching = strictlyBefore ?? sameLine;
+        if (reaching)
+            use.def_id = reaching.id;
+    }
+}
 /**
  * Compute def-use chains.
  *
@@ -1023,7 +1100,7 @@ function computeChains(defs, uses) {
             for (const use of usesOnLine) {
                 // If this use has a reaching def, create a chain
                 if (use.def_id !== null && use.def_id !== def.id) {
-                    const key = `${use.def_id}${def.id}${use.variable}`;
+                    const key = `${use.def_id}\0${def.id}\0${use.variable}`;
                     if (!seenChains.has(key)) {
                         seenChains.add(key);
                         chains.push({