circle-ir 4.9.13 → 4.9.14

package/dist/browser/circle-ir.js

@@ -6700,6 +6700,14 @@ function buildResolutionContext(tree, cache) {
       }
     }
   }
+  const resourceDecls = getNodesFromCache(tree.rootNode, "resource", cache);
+  for (const res of resourceDecls) {
+    const typeNode = res.childForFieldName("type");
+    const nameNode = res.childForFieldName("name");
+    if (typeNode && nameNode) {
+      context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+    }
+  }
   const imports = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const imp of imports) {
     const text = getNodeText(imp);
@@ -12372,9 +12380,27 @@ var DEFAULT_SINKS = [
   // Command Injection (CWE-78)
   { method: "exec", class: "Runtime", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "start", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [] },
-  // ProcessBuilder constructor
-  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // ProcessBuilder constructor + command(): cognium-dev#351 — BOTH take
+  // `String...` varargs (or a single List<String>), and EVERY element is a
+  // command token, so no position is safe. Pinning these to `[0]` missed the
+  // canonical shell-wrapper shape, where the payload is the last argument:
+  //
+  //   new ProcessBuilder("bash", "-c", tainted)     // payload at position 2
+  //   pb.command("bash", "-c", tainted)
+  //
+  // `Runtime.exec(String[])` with the identical array already fired, so the
+  // taint was available and only the sink model was wrong.
+  //
+  // The positions are enumerated rather than left `[]` because the two layers
+  // that read this field disagree about what an empty array means:
+  // `isInDangerousPosition` (taint-matcher) does `arg_positions.includes(pos)`,
+  // so `[]` matches NOTHING, while the sink-reachability loop in
+  // taint-propagation treats `length === 0` as "any argument".
+  // `ProcessBuilder.start` gets away with `[]` only because it takes no
+  // arguments at all. Enumerating is unambiguous in both, and matches how the
+  // logging sinks in this file already spell it.
+  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   // Commons Exec
   // Note: bare class 'Executor' removed — it collided with java.util.concurrent.Executor
   // (Executor.execute(Runnable) is not command injection). Apache Commons Exec users
@@ -13652,8 +13678,10 @@ var DEFAULT_SINKS = [
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
-  // Collection-based command injection (ProcessBuilder with List)
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Collection-based command injection (ProcessBuilder with List) — the
+  // `ProcessBuilder.command` entry lives with the other ProcessBuilder sinks
+  // above; a second copy here only risked the two drifting apart, which is
+  // what happened (cognium-dev#351).
   // ProcessBuilder.inheritIO removed in 3.83.0 (#124): no args, no command
   // string flows into it. See note above next to the Process-related cluster.
   // Jenkins DSL patterns
@@ -15583,7 +15611,7 @@ function isSafeGoExecCommandCall(call, pattern, language) {
     const stripped = expr.slice(1, -1);
     program = stripped.split("/").pop() ?? stripped;
   }
-  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  const SHELL_PROGRAMS2 = /* @__PURE__ */ new Set([
     "sh",
     "bash",
     "zsh",
@@ -15597,7 +15625,7 @@ function isSafeGoExecCommandCall(call, pattern, language) {
     "powershell.exe",
     "pwsh.exe"
   ]);
-  if (SHELL_PROGRAMS.has(program)) return false;
+  if (SHELL_PROGRAMS2.has(program)) return false;
   const PACKAGE_MANAGER_EXEC_SUBCOMMANDS = {
     go: /* @__PURE__ */ new Set(["install", "run", "get"]),
     npm: /* @__PURE__ */ new Set(["install", "i", "exec"]),
@@ -15648,7 +15676,7 @@ function isSafeJSChildProcessCall(call, pattern, language) {
     const stripped = expr.slice(1, -1);
     program = stripped.split("/").pop() ?? stripped;
   }
-  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  const SHELL_PROGRAMS2 = /* @__PURE__ */ new Set([
     "sh",
     "bash",
     "zsh",
@@ -15662,7 +15690,7 @@ function isSafeJSChildProcessCall(call, pattern, language) {
     "powershell.exe",
     "pwsh.exe"
   ]);
-  if (SHELL_PROGRAMS.has(program)) return false;
+  if (SHELL_PROGRAMS2.has(program)) return false;
   return true;
 }
 var CSHARP_SHELL_PROGRAMS = /* @__PURE__ */ new Set([
@@ -15895,7 +15923,7 @@ function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
   if (pattern.class !== void 0 && pattern.class !== "Command") return false;
-  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  const SHELL_PROGRAMS2 = /* @__PURE__ */ new Set([
     "sh",
     "bash",
     "zsh",
@@ -15930,13 +15958,13 @@ function isSafeRustCommandCall(call, pattern, language) {
       const stripped = expr.slice(1, -1);
       program = stripped.split("/").pop() ?? stripped;
     }
-    return !SHELL_PROGRAMS.has(program);
+    return !SHELL_PROGRAMS2.has(program);
   }
   if (pattern.method === "arg" || pattern.method === "args" || pattern.method === "spawn" || pattern.method === "output") {
     const receiverText = call.receiver ?? "";
     const program = extractProgram(receiverText);
     if (program === null) return false;
-    return !SHELL_PROGRAMS.has(program);
+    return !SHELL_PROGRAMS2.has(program);
   }
   return false;
 }
@@ -33881,6 +33909,29 @@ var PROTOCOL_CLIENT_PACKAGES = [
 ];
 var OS_EXEC_RECEIVER_RE = /\b(?:Runtime|ProcessBuilder|DefaultExecutor|Executor|Exec|Launcher|ProcStarter|ProcessExecutor|RuntimeUtil)\s*[.(]/;
 var PROCESS_BUILDER_ARGV_FORM_RE = /\bnew\s+ProcessBuilder\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+var PROCESS_BUILDER_COMMAND_ARGV_FORM_RE = /\.\s*command\s*\(\s*(?:Arrays\.asList\b|List\.of\b|Collections\.singletonList\b|new\s+ArrayList\b|new\s+String\s*\[\s*\]\s*\{|"[^"]*"\s*,)/;
+var SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "ksh",
+  "dash",
+  "ash",
+  "csh",
+  "tcsh",
+  "fish",
+  "cmd",
+  "command",
+  "powershell",
+  "pwsh"
+]);
+var ARGV_FIRST_LITERAL_RE = /(?:\bnew\s+ProcessBuilder\s*\(|\.\s*command\s*\()\s*(?:Arrays\.asList\s*\(|List\.of\s*\(|Collections\.singletonList\s*\(|new\s+ArrayList\s*(?:<[^>]*>)?\s*\(\s*(?:Arrays\.asList\s*\()?|new\s+String\s*\[\s*\]\s*\{)?\s*"([^"]*)"/;
+function argvFirstLiteralIsShell(lineText) {
+  const m = ARGV_FIRST_LITERAL_RE.exec(lineText);
+  if (!m) return false;
+  const base = m[1].split(/[\\/]/).pop().replace(/\.exe$/i, "").toLowerCase();
+  return SHELL_PROGRAMS.has(base);
+}
 var JAVA_THROW_STATEMENT_RE = /^\s*throw\s+new\s+\w+(?:Exception|Error)\b[^;]*;\s*(?:\/\/.*|\/\*.*)?$/;
 var JEXL_ENGINE_TYPES = /* @__PURE__ */ new Set(["JexlEngine", "Jexl", "JxltEngine"]);
 var JEXL_EXPRESSION_TYPE_RE = /(?:Jexl)?(?:Expression|Script|Template)(?:Script)?$/;
@@ -34028,6 +34079,27 @@ function jsSsrfHostGuardedLines(code) {
   return covered;
 }
 var CSHARP_ALLOWLIST_STRIP_RE = /\bRegex\s*\.\s*Replace\s*\([^,]*,\s*@?"\[\^(?:[A-Za-z0-9_\- ]|\\w|\\d|\\s)+\]"\s*,\s*@?"[A-Za-z0-9_]?"\s*\)/;
+function isUnwrittenLocalMapKeyRead(code, source) {
+  if (source.type !== "plugin_param") return false;
+  const lines = code.split("\n");
+  const lineText = lines[source.line - 1] ?? "";
+  const read = /\b([A-Za-z_]\w*)\s*\.\s*get\s*\(\s*"([^"]*)"\s*\)/.exec(lineText);
+  if (!read) return false;
+  const [, recv, key] = read;
+  const ctorRe = new RegExp(
+    `\\b${recv}\\s*=\\s*new\\s+(?:Hash|Tree|LinkedHash|ConcurrentHash|Concurrent|Identity|Weak)?Map\\s*(?:<[^>]*>)?\\s*\\(`
+  );
+  if (!lines.some((l) => ctorRe.test(l))) return false;
+  const escapeRe2 = new RegExp(`\\w\\s*\\([^)]*(?<![\\w.])${recv}(?![\\w.])[^)]*\\)`);
+  for (const l of lines) {
+    if (!escapeRe2.test(l)) continue;
+    const stripped = l.replace(new RegExp(`\\b${recv}\\s*\\.\\s*\\w+\\s*\\(`, "g"), "X(");
+    if (escapeRe2.test(stripped)) return false;
+  }
+  const putRe = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}"`);
+  if (lines.some((l) => putRe.test(l))) return false;
+  return true;
+}
 var CSHARP_SANITIZER_RES = [
   { re: /\b(?:HtmlEncode|JavaScriptStringEncode)\s*\(/, type: "xss" },
   { re: /\bHtmlEncoder\s*\.\s*Encode\s*\(/, type: "xss" },
@@ -34280,9 +34352,10 @@ var SinkFilterPass = class {
     const constProp = ctx.getResult("constant-propagation");
     const langSources = ctx.getResult("language-sources");
     const mergedSources = [...taintMatcher.sources, ...langSources.additionalSources];
-    const sources = ctx.code && ctx.language ? mergedSources.filter(
+    const executableSources = ctx.code && ctx.language ? mergedSources.filter(
       (s) => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language)
     ) : mergedSources;
+    const sources = ctx.code ? executableSources.filter((s) => !isUnwrittenLocalMapKeyRead(ctx.code, s)) : executableSources;
     const sinks = [...taintMatcher.sinks];
     for (const s of langSources.additionalSinks) {
       if (!sinks.some((x) => x.line === s.line && x.cwe === s.cwe && x.type === s.type)) {
@@ -34550,10 +34623,19 @@ var SinkFilterPass = class {
       const irTypes = ctx.graph.ir.types;
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection") return true;
-        if (sink.method !== "ProcessBuilder" && sink.method !== "start") return true;
+        if (sink.method !== "ProcessBuilder" && sink.method !== "start" && sink.method !== "command") {
+          return true;
+        }
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText)) return true;
-        if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText)) return false;
+        const isCtorLine = /\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText);
+        const isCommandLine = /\.\s*command\s*\(/.test(sinkLineText);
+        if (!isCtorLine && !isCommandLine) return true;
+        if (argvFirstLiteralIsShell(sinkLineText)) return true;
+        if (isCtorLine && PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText)) return false;
+        if (isCommandLine && PROCESS_BUILDER_COMMAND_ARGV_FORM_RE.test(sinkLineText)) {
+          return false;
+        }
+        if (!isCtorLine) return true;
         const ctorCall = irCalls.find(
           (c) => c.method_name === "ProcessBuilder" && c.location.line === sink.line && (c.receiver === null || c.receiver === void 0)
         );
@@ -37124,6 +37206,103 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   }
   return false;
 }
+var MASKABLE_STRING_LANGUAGES = /* @__PURE__ */ new Set(["python", "javascript", "typescript"]);
+function maskStringLiteralsForTokenScan(expr) {
+  let out2 = "";
+  let i2 = 0;
+  const braceExprs = (body2) => {
+    let acc = "";
+    for (let j = 0; j < body2.length; ) {
+      if (body2[j] === "{" && body2[j + 1] === "{") {
+        j += 2;
+        continue;
+      }
+      if (body2[j] === "}" && body2[j + 1] === "}") {
+        j += 2;
+        continue;
+      }
+      if (body2[j] === "{") {
+        j++;
+        let depth = 1;
+        let inner = "";
+        while (j < body2.length && depth > 0) {
+          if (body2[j] === "{") depth++;
+          else if (body2[j] === "}") {
+            depth--;
+            if (depth === 0) break;
+          }
+          inner += body2[j];
+          j++;
+        }
+        j++;
+        acc += " " + maskStringLiteralsForTokenScan(inner) + " ";
+        continue;
+      }
+      j++;
+    }
+    return acc;
+  };
+  while (i2 < expr.length) {
+    const ch = expr[i2];
+    if (ch === "`") {
+      i2++;
+      let acc = "";
+      while (i2 < expr.length && expr[i2] !== "`") {
+        if (expr[i2] === "\\") {
+          i2 += 2;
+          continue;
+        }
+        if (expr[i2] === "$" && expr[i2 + 1] === "{") {
+          i2 += 2;
+          let depth = 1;
+          let inner = "";
+          while (i2 < expr.length && depth > 0) {
+            if (expr[i2] === "{") depth++;
+            else if (expr[i2] === "}") {
+              depth--;
+              if (depth === 0) break;
+            }
+            inner += expr[i2];
+            i2++;
+          }
+          i2++;
+          acc += " " + maskStringLiteralsForTokenScan(inner) + " ";
+          continue;
+        }
+        i2++;
+      }
+      i2++;
+      out2 += " " + acc + " ";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      const pm = /[A-Za-z_][A-Za-z0-9_]*$/.exec(out2);
+      const prefix = pm ? pm[0] : "";
+      const isPrefix = prefix.length > 0 && /^[rRbBuUfF]+$/.test(prefix);
+      const isF = isPrefix && /[fF]/.test(prefix);
+      if (isPrefix) out2 = out2.slice(0, out2.length - prefix.length) + " ";
+      const triple = expr.startsWith(ch.repeat(3), i2);
+      const delim = triple ? ch.repeat(3) : ch;
+      i2 += delim.length;
+      let body2 = "";
+      while (i2 < expr.length && !expr.startsWith(delim, i2)) {
+        if (expr[i2] === "\\") {
+          body2 += " ";
+          i2 += 2;
+          continue;
+        }
+        body2 += expr[i2];
+        i2++;
+      }
+      i2 += delim.length;
+      out2 += isF ? " " + braceExprs(body2) + " " : " ";
+      continue;
+    }
+    out2 += ch;
+    i2++;
+  }
+  return out2;
+}
 function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachableLines, tainted, code, language, types) {
   const flows = [];
   const sourcesWithVar = sources.filter(
@@ -37477,7 +37656,8 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         }
         const expr = arg.expression;
         if (!expr) continue;
-        const exprIdentMatches = expr.match(/[\p{L}\p{N}_]+/gu);
+        const scannable = language !== void 0 && MASKABLE_STRING_LANGUAGES.has(language) ? maskStringLiteralsForTokenScan(expr) : expr;
+        const exprIdentMatches = scannable.match(/[\p{L}\p{N}_]+/gu);
         let candidates = complexSources.length > 0 ? complexSources.slice() : null;
         if (exprIdentMatches) {
           for (const id of new Set(exprIdentMatches)) {

package/dist/core/circle-ir-core.cjs

@@ -6746,6 +6746,14 @@ function buildResolutionContext(tree, cache) {
       }
     }
   }
+  const resourceDecls = getNodesFromCache(tree.rootNode, "resource", cache);
+  for (const res of resourceDecls) {
+    const typeNode = res.childForFieldName("type");
+    const nameNode = res.childForFieldName("name");
+    if (typeNode && nameNode) {
+      context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+    }
+  }
   const imports = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const imp of imports) {
     const text = getNodeText(imp);
@@ -11767,9 +11775,27 @@ var DEFAULT_SINKS = [
   // Command Injection (CWE-78)
   { method: "exec", class: "Runtime", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "start", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [] },
-  // ProcessBuilder constructor
-  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // ProcessBuilder constructor + command(): cognium-dev#351 — BOTH take
+  // `String...` varargs (or a single List<String>), and EVERY element is a
+  // command token, so no position is safe. Pinning these to `[0]` missed the
+  // canonical shell-wrapper shape, where the payload is the last argument:
+  //
+  //   new ProcessBuilder("bash", "-c", tainted)     // payload at position 2
+  //   pb.command("bash", "-c", tainted)
+  //
+  // `Runtime.exec(String[])` with the identical array already fired, so the
+  // taint was available and only the sink model was wrong.
+  //
+  // The positions are enumerated rather than left `[]` because the two layers
+  // that read this field disagree about what an empty array means:
+  // `isInDangerousPosition` (taint-matcher) does `arg_positions.includes(pos)`,
+  // so `[]` matches NOTHING, while the sink-reachability loop in
+  // taint-propagation treats `length === 0` as "any argument".
+  // `ProcessBuilder.start` gets away with `[]` only because it takes no
+  // arguments at all. Enumerating is unambiguous in both, and matches how the
+  // logging sinks in this file already spell it.
+  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   // Commons Exec
   // Note: bare class 'Executor' removed — it collided with java.util.concurrent.Executor
   // (Executor.execute(Runnable) is not command injection). Apache Commons Exec users
@@ -13047,8 +13073,10 @@ var DEFAULT_SINKS = [
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
-  // Collection-based command injection (ProcessBuilder with List)
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Collection-based command injection (ProcessBuilder with List) — the
+  // `ProcessBuilder.command` entry lives with the other ProcessBuilder sinks
+  // above; a second copy here only risked the two drifting apart, which is
+  // what happened (cognium-dev#351).
   // ProcessBuilder.inheritIO removed in 3.83.0 (#124): no args, no command
   // string flows into it. See note above next to the Process-related cluster.
   // Jenkins DSL patterns

package/dist/core/circle-ir-core.js

@@ -6680,6 +6680,14 @@ function buildResolutionContext(tree, cache) {
       }
     }
   }
+  const resourceDecls = getNodesFromCache(tree.rootNode, "resource", cache);
+  for (const res of resourceDecls) {
+    const typeNode = res.childForFieldName("type");
+    const nameNode = res.childForFieldName("name");
+    if (typeNode && nameNode) {
+      context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+    }
+  }
   const imports = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const imp of imports) {
     const text = getNodeText(imp);
@@ -11701,9 +11709,27 @@ var DEFAULT_SINKS = [
   // Command Injection (CWE-78)
   { method: "exec", class: "Runtime", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "start", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [] },
-  // ProcessBuilder constructor
-  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // ProcessBuilder constructor + command(): cognium-dev#351 — BOTH take
+  // `String...` varargs (or a single List<String>), and EVERY element is a
+  // command token, so no position is safe. Pinning these to `[0]` missed the
+  // canonical shell-wrapper shape, where the payload is the last argument:
+  //
+  //   new ProcessBuilder("bash", "-c", tainted)     // payload at position 2
+  //   pb.command("bash", "-c", tainted)
+  //
+  // `Runtime.exec(String[])` with the identical array already fired, so the
+  // taint was available and only the sink model was wrong.
+  //
+  // The positions are enumerated rather than left `[]` because the two layers
+  // that read this field disagree about what an empty array means:
+  // `isInDangerousPosition` (taint-matcher) does `arg_positions.includes(pos)`,
+  // so `[]` matches NOTHING, while the sink-reachability loop in
+  // taint-propagation treats `length === 0` as "any argument".
+  // `ProcessBuilder.start` gets away with `[]` only because it takes no
+  // arguments at all. Enumerating is unambiguous in both, and matches how the
+  // logging sinks in this file already spell it.
+  { method: "ProcessBuilder", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
+  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1, 2, 3, 4, 5, 6, 7] },
   // Commons Exec
   // Note: bare class 'Executor' removed — it collided with java.util.concurrent.Executor
   // (Executor.execute(Runnable) is not command injection). Apache Commons Exec users
@@ -12981,8 +13007,10 @@ var DEFAULT_SINKS = [
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
-  // Collection-based command injection (ProcessBuilder with List)
-  { method: "command", class: "ProcessBuilder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Collection-based command injection (ProcessBuilder with List) — the
+  // `ProcessBuilder.command` entry lives with the other ProcessBuilder sinks
+  // above; a second copy here only risked the two drifting apart, which is
+  // what happened (cognium-dev#351).
   // ProcessBuilder.inheritIO removed in 3.83.0 (#124): no args, no command
   // string flows into it. See note above next to the Process-related cluster.
   // Jenkins DSL patterns

package/dist/core/extractors/calls.js

@@ -1049,6 +1049,25 @@ function buildResolutionContext(tree, cache) {
             }
         }
     }
+    // cognium-dev#350 — try-with-resources declarations are ALSO local variables.
+    //
+    //   try (Connection c = …; Statement s = c.createStatement()) { s.executeQuery(q); }
+    //
+    // A resource is a `resource` node under `resource_specification`, and it holds
+    // its type and name directly — there is no `variable_declarator` child — so
+    // the loop above never sees it. Without an entry here the receiver type stays
+    // `null`, the class-scoped `Statement.executeQuery` sink cannot match, and the
+    // call degrades to the generic `external_taint_escape` fallback: the sink is
+    // still reported, but as CWE-668 instead of CWE-89. That is the idiomatic JDBC
+    // form and the shape most real Spring code uses.
+    const resourceDecls = getNodesFromCache(tree.rootNode, 'resource', cache);
+    for (const res of resourceDecls) {
+        const typeNode = res.childForFieldName('type');
+        const nameNode = res.childForFieldName('name');
+        if (typeNode && nameNode) {
+            context.localVarTypes.set(getNodeText(nameNode), getNodeText(typeNode));
+        }
+    }
     // Collect imports — map simple class name to FQN
     const imports = getNodesFromCache(tree.rootNode, 'import_declaration', cache);
     for (const imp of imports) {