circle-ir 4.9.21 → 4.9.22

package/dist/analysis/modelled-cwes.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Modelled-CWE export (cognium-dev#393).
+ *
+ * Which weakness classes does the taint engine have a model for? Anything that
+ * scores the engine against a CWE-labelled corpus needs the answer, and a
+ * hand-kept list drifts and can be tuned. This derives it from the same runtime
+ * registries the analyzer matches against, so it is always the truth for the
+ * installed version and grows as sinks are added.
+ *
+ * "Modelled" is deliberately narrow: a CWE some SINK pattern is registered
+ * under. Non-taint pattern passes (weak crypto, missing headers, resource
+ * leaks …) stamp their CWE on each finding and have no registry to enumerate,
+ * so they are out of this export rather than half-listed.
+ */
+/**
+ * Ids an advisory may carry for a class the engine models under another id —
+ * a child or sibling that reaches the same sink family. Keyed advisory-side,
+ * valued with the modelled id. Kept short and literal on purpose: each entry
+ * widens what counts as in scope, so each is a claim someone can check.
+ */
+export declare const RELATED_CWE: Readonly<Record<string, string>>;
+export interface ModelledCwes {
+    /** CWEs at least one registered sink pattern carries, sorted numerically. */
+    sinkCwes: string[];
+    /** Advisory-side ids that map onto a modelled class; see `RELATED_CWE`. */
+    related: Readonly<Record<string, string>>;
+}
+/** The engine's modelled taint classes, derived from the live sink registries. */
+export declare function getModelledCwes(): ModelledCwes;
+/**
+ * Is `cwe` a class the taint engine models, directly or through `RELATED_CWE`?
+ * A related id counts only while the id it maps to is itself still modelled.
+ */
+export declare function isModelledCwe(cwe: string, modelled?: ModelledCwes): boolean;
+//# sourceMappingURL=modelled-cwes.d.ts.map

package/dist/analysis/modelled-cwes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelled-cwes.d.ts","sourceRoot":"","sources":["../../src/analysis/modelled-cwes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcvD,CAAC;AAEH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2EAA2E;IAC3E,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C;AAKD,kFAAkF;AAClF,wBAAgB,eAAe,IAAI,YAAY,CAO9C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,GAAE,YAAgC,GAAG,OAAO,CAK9F"}

package/dist/analysis/modelled-cwes.js

@@ -0,0 +1,63 @@
+/**
+ * Modelled-CWE export (cognium-dev#393).
+ *
+ * Which weakness classes does the taint engine have a model for? Anything that
+ * scores the engine against a CWE-labelled corpus needs the answer, and a
+ * hand-kept list drifts and can be tuned. This derives it from the same runtime
+ * registries the analyzer matches against, so it is always the truth for the
+ * installed version and grows as sinks are added.
+ *
+ * "Modelled" is deliberately narrow: a CWE some SINK pattern is registered
+ * under. Non-taint pattern passes (weak crypto, missing headers, resource
+ * leaks …) stamp their CWE on each finding and have no registry to enumerate,
+ * so they are out of this export rather than half-listed.
+ */
+import { DEFAULT_SINKS } from './config-loader.js';
+import { createBuiltinPlugins } from '../languages/plugins/index.js';
+/**
+ * Ids an advisory may carry for a class the engine models under another id —
+ * a child or sibling that reaches the same sink family. Keyed advisory-side,
+ * valued with the modelled id. Kept short and literal on purpose: each entry
+ * widens what counts as in scope, so each is a claim someone can check.
+ */
+export const RELATED_CWE = Object.freeze({
+    'CWE-23': 'CWE-22', // relative path traversal
+    'CWE-36': 'CWE-22', // absolute path traversal
+    'CWE-73': 'CWE-22', // external control of file name or path
+    'CWE-77': 'CWE-78', // command injection (generic) -> OS command injection
+    'CWE-88': 'CWE-78', // argument injection
+    'CWE-80': 'CWE-79', // basic XSS
+    'CWE-564': 'CWE-89', // SQL injection: Hibernate
+    'CWE-95': 'CWE-94', // eval injection
+    'CWE-917': 'CWE-94', // expression language injection
+    'CWE-1336': 'CWE-94', // template engine injection
+    'CWE-93': 'CWE-113', // CRLF injection -> HTTP response splitting
+    'CWE-91': 'CWE-643', // XML injection -> XPath injection
+    'CWE-776': 'CWE-611', // entity expansion -> external entities (same parser config)
+});
+const byNumber = (a, b) => Number(a.slice(4)) - Number(b.slice(4));
+/** The engine's modelled taint classes, derived from the live sink registries. */
+export function getModelledCwes() {
+    const cwes = new Set();
+    for (const sink of DEFAULT_SINKS)
+        if (sink.cwe)
+            cwes.add(sink.cwe);
+    for (const plugin of createBuiltinPlugins()) {
+        for (const sink of plugin.getBuiltinSinks())
+            if (sink.cwe)
+                cwes.add(sink.cwe);
+    }
+    return { sinkCwes: [...cwes].sort(byNumber), related: RELATED_CWE };
+}
+/**
+ * Is `cwe` a class the taint engine models, directly or through `RELATED_CWE`?
+ * A related id counts only while the id it maps to is itself still modelled.
+ */
+export function isModelledCwe(cwe, modelled = getModelledCwes()) {
+    const direct = new Set(modelled.sinkCwes);
+    if (direct.has(cwe))
+        return true;
+    const parent = modelled.related[cwe];
+    return parent !== undefined && direct.has(parent);
+}
+//# sourceMappingURL=modelled-cwes.js.map

package/dist/analysis/modelled-cwes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelled-cwes.js","sourceRoot":"","sources":["../../src/analysis/modelled-cwes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAqC,MAAM,CAAC,MAAM,CAAC;IACzE,QAAQ,EAAE,QAAQ,EAAI,0BAA0B;IAChD,QAAQ,EAAE,QAAQ,EAAI,0BAA0B;IAChD,QAAQ,EAAE,QAAQ,EAAI,wCAAwC;IAC9D,QAAQ,EAAE,QAAQ,EAAI,sDAAsD;IAC5E,QAAQ,EAAE,QAAQ,EAAI,qBAAqB;IAC3C,QAAQ,EAAE,QAAQ,EAAI,YAAY;IAClC,SAAS,EAAE,QAAQ,EAAG,2BAA2B;IACjD,QAAQ,EAAE,QAAQ,EAAI,iBAAiB;IACvC,SAAS,EAAE,QAAQ,EAAG,gCAAgC;IACtD,UAAU,EAAE,QAAQ,EAAE,4BAA4B;IAClD,QAAQ,EAAE,SAAS,EAAG,4CAA4C;IAClE,QAAQ,EAAE,SAAS,EAAG,mCAAmC;IACzD,SAAS,EAAE,SAAS,EAAE,6DAA6D;CACpF,CAAC,CAAC;AASH,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CAChD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1C,kFAAkF;AAClF,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,aAAa;QAAE,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,eAAe,EAAE;YAAE,IAAI,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,QAAQ,GAAiB,eAAe,EAAE;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/analysis/passes/xml-entity-expansion-pass.d.ts

@@ -1,5 +1,5 @@
 /**
- * Pass: xml-entity-expansion (CWE-776 / CWE-611, category: security)
+ * Pass: xml-entity-expansion (CWE-611 / CWE-776, category: security)
  *
  * Pattern pass — flags XML parser instantiation that does *not* disable
  * DTD / external-entity processing in the same file. This covers:
@@ -14,8 +14,11 @@
  *     - `XMLInputFactory.newInstance()` (StAX)
  *     - `SchemaFactory.newInstance(...)`
  *     - `TransformerFactory.newInstance()`
- *   Safe-feature setters (any of these in the same file silences the
- *   finding for that factory class):
+ *   Safe-feature setters. Any of these in the file silences a factory
+ *   UNLESS that factory is a local variable which provably never receives
+ *   one (no hardening-capable setter on it in its method, never passed to
+ *   another call, never returned) — so one hardened factory no longer masks
+ *   an unhardened one beside it:
  *     - `setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`
  *     - `setFeature("http://xml.org/sax/features/external-general-entities", false)`
  *     - `setFeature("http://xml.org/sax/features/external-parameter-entities", false)`
@@ -35,6 +38,19 @@
  * because billion-laughs is exploitable via any attacker-supplied entity
  * file even when the parse() argument itself is trusted.
  *
+ * CWE is assigned PER API, by which weakness the unhardened default actually
+ * leaves open (#426) — the same per-API reasoning `language-sources-pass`
+ * applies to Python's `xml.sax`:
+ *   - Java JAXP factories  -> CWE-611. External entity resolution is ON by
+ *     default, while JAXP has shipped a default entity-expansion limit for
+ *     years, so the live risk on a current JDK is external entities. Every
+ *     hardening token this pass looks for is an external-entity control.
+ *   - `lxml.etree`         -> CWE-611. `resolve_entities` defaults on.
+ *   - `xml.etree.ElementTree` -> CWE-776. It never resolves external entities;
+ *     what remains is entity expansion.
+ * The JS variant of this rule (`libxmljs` `noent: true`) already reported
+ * CWE-611, so before this the rule disagreed with itself across languages.
+ *
  * Issue: #86, Sprint 6.
  */
 import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
@@ -50,6 +66,33 @@ export declare class XmlEntityExpansionPass implements AnalysisPass<XmlEntityExp
     readonly name = "xml-entity-expansion";
     readonly category: 'security';
     run(ctx: PassContext): XmlEntityExpansionResult;
+    private methodRanges;
+    /**
+     * In a file that DOES contain hardening evidence, is the factory created on
+     * `line` one that provably never receives it?
+     *
+     * Deliberately one-sided. It answers true for exactly two shapes:
+     *
+     *   1. CHAINED — `Factory.newInstance().newDocumentBuilder()`, where the
+     *      product is not handed on or returned either.
+     *   2. LOCAL — `Factory f = Factory.newInstance();` where the enclosing method
+     *      builds a parser from `f`, never hands `f` to another call, and never
+     *      returns it.
+     *
+     * and in both only when the enclosing method contains NO hardening-capable
+     * setter on ANY receiver, since hardening may land on the factory's product
+     * (`parser.getXMLReader().setFeature(…)`) rather than the factory.
+     *
+     * Every other shape — a field, a helper that takes the factory, a caller that
+     * receives it — may be hardened somewhere this check cannot see, so it keeps
+     * the previous file-level silence.
+     *
+     * A TransformerFactory additionally needs a `StreamSource` in its method: that
+     * is the input the transformer parses with its OWN parser. Fed a `DOMSource`
+     * it parses nothing, and fed a `SAXSource` it uses the reader it was given —
+     * whose hardening is that reader's business, not this factory's.
+     */
+    private isProvablyUnhardened;
     private detectJavaCall;
     private detectPythonCall;
     private fixForJava;

package/dist/analysis/passes/xml-entity-expansion-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xml-entity-expansion-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA6C9E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,sBACX,YAAW,YAAY,CAAC,wBAAwB,CAAC;IAEjD,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB,CAsF9C;IAED,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,UAAU;IA6BlB,OAAO,CAAC,YAAY;CAarB"}
+{"version":3,"file":"xml-entity-expansion-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAwD9E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,sBACX,YAAW,YAAY,CAAC,wBAAwB,CAAC;IAEjD,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB,CAmG9C;IAED,OAAO,CAAC,YAAY;IAWpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,oBAAoB;IA0D5B,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,UAAU;IA6BlB,OAAO,CAAC,YAAY;CAarB"}

package/dist/analysis/passes/xml-entity-expansion-pass.js

@@ -1,5 +1,5 @@
 /**
- * Pass: xml-entity-expansion (CWE-776 / CWE-611, category: security)
+ * Pass: xml-entity-expansion (CWE-611 / CWE-776, category: security)
  *
  * Pattern pass — flags XML parser instantiation that does *not* disable
  * DTD / external-entity processing in the same file. This covers:
@@ -14,8 +14,11 @@
  *     - `XMLInputFactory.newInstance()` (StAX)
  *     - `SchemaFactory.newInstance(...)`
  *     - `TransformerFactory.newInstance()`
- *   Safe-feature setters (any of these in the same file silences the
- *   finding for that factory class):
+ *   Safe-feature setters. Any of these in the file silences a factory
+ *   UNLESS that factory is a local variable which provably never receives
+ *   one (no hardening-capable setter on it in its method, never passed to
+ *   another call, never returned) — so one hardened factory no longer masks
+ *   an unhardened one beside it:
  *     - `setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`
  *     - `setFeature("http://xml.org/sax/features/external-general-entities", false)`
  *     - `setFeature("http://xml.org/sax/features/external-parameter-entities", false)`
@@ -35,6 +38,19 @@
  * because billion-laughs is exploitable via any attacker-supplied entity
  * file even when the parse() argument itself is trusted.
  *
+ * CWE is assigned PER API, by which weakness the unhardened default actually
+ * leaves open (#426) — the same per-API reasoning `language-sources-pass`
+ * applies to Python's `xml.sax`:
+ *   - Java JAXP factories  -> CWE-611. External entity resolution is ON by
+ *     default, while JAXP has shipped a default entity-expansion limit for
+ *     years, so the live risk on a current JDK is external entities. Every
+ *     hardening token this pass looks for is an external-entity control.
+ *   - `lxml.etree`         -> CWE-611. `resolve_entities` defaults on.
+ *   - `xml.etree.ElementTree` -> CWE-776. It never resolves external entities;
+ *     what remains is entity expansion.
+ * The JS variant of this rule (`libxmljs` `noent: true`) already reported
+ * CWE-611, so before this the rule disagreed with itself across languages.
+ *
  * Issue: #86, Sprint 6.
  */
 const JAVA_FACTORIES = new Set([
@@ -63,6 +79,13 @@ const JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\
 //   - file calls NO builder.parse(...) (never reads bytes)
 const JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
 const JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
+// Any call that CAN carry XML hardening, on any receiver — factory, parser,
+// reader, validator or transformer. Matched by name, not argument, because the
+// feature string is routinely a constant declared elsewhere.
+const JAVA_HARDENING_SETTER_RE = /\.\s*(?:setFeature|setAttribute|setProperty|setXIncludeAware|setExpandEntityReferences)\s*\(/;
+// A factory consumed in the same expression that creates it — never bound to a
+// name, so it can never be configured.
+const JAVA_FACTORY_CHAINED_RE = /\bnewInstance\s*\([^()]*\)\s*\.\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\s*\(/;
 const PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 export class XmlEntityExpansionPass {
     name = 'xml-entity-expansion';
@@ -74,8 +97,15 @@ export class XmlEntityExpansionPass {
         const code = ctx.code ?? '';
         if (language === 'java') {
             const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
-            if (safeInFile)
-                return { findings };
+            // Hardening evidence used to silence the WHOLE file, so one hardened
+            // factory masked every other factory beside it. When evidence exists,
+            // keep only the factories that provably never receive it (see
+            // `isProvablyUnhardened`); anything ambiguous stays silent, as before.
+            // `jdk.xml.*` limits are set process-wide (System.setProperty), so they
+            // reach every factory regardless of which variable the file touches.
+            const processWide = safeInFile && /jdk\.xml\./.test(code);
+            const lines = safeInFile ? code.split('\n') : [];
+            const methodRanges = safeInFile ? this.methodRanges(graph.ir.types) : [];
             // #173 — output-only TransformerFactory + empty DocumentBuilder.
             // File-level heuristics; conservative-bias (only suppress when the
             // file shows ONLY the safe shape and NO unsafe shape).
@@ -93,6 +123,8 @@ export class XmlEntityExpansionPass {
                 if (det.api === 'DocumentBuilderFactory' && isDocumentBuilderEmptyOnly)
                     continue;
                 const line = call.location.line;
+                if (safeInFile && (processWide || !this.isProvablyUnhardened(lines, line, methodRanges, det.api)))
+                    continue;
                 findings.push({ line, language, ...det });
                 ctx.addFinding({
                     id: `${this.name}-${file}-${line}-${det.api}`,
@@ -103,15 +135,15 @@ export class XmlEntityExpansionPass {
                     severity: 'high',
                     level: 'error',
                     message: `${det.api} created without disabling DTD / external-entity ` +
-                        'processing. Vulnerable to billion-laughs / quadratic ' +
-                        'blow-up DoS (CWE-776) and external-entity disclosure ' +
-                        '(CWE-611). Add `setFeature("http://apache.org/xml/features/' +
+                        'processing. Vulnerable to external-entity disclosure ' +
+                        '(CWE-611) and billion-laughs / quadratic blow-up DoS ' +
+                        '(CWE-776). Add `setFeature("http://apache.org/xml/features/' +
                         'disallow-doctype-decl", true)` (or the equivalent) before ' +
                         'parsing.',
                     file,
                     line,
                     fix: this.fixForJava(det.api),
-                    evidence: { ...det, language, safeFeatureInFile: false },
+                    evidence: { ...det, language, safeFeatureInFile: safeInFile },
                 });
             }
             return { findings };
@@ -136,8 +168,11 @@ export class XmlEntityExpansionPass {
                     severity: 'high',
                     level: 'error',
                     message: `${det.api} called without an entity-safe parser. Vulnerable ` +
-                        'to billion-laughs / quadratic blow-up DoS (CWE-776) and ' +
-                        'external-entity disclosure (CWE-611). Use `defusedxml` or pass ' +
+                        (det.cwe === 'CWE-611'
+                            ? 'to external-entity disclosure (CWE-611) and billion-laughs / ' +
+                                'quadratic blow-up DoS (CWE-776). '
+                            : 'to billion-laughs / quadratic blow-up DoS (CWE-776). ') +
+                        'Use `defusedxml` or pass ' +
                         'an `XMLParser(resolve_entities=False)` to lxml.',
                     file,
                     line,
@@ -149,6 +184,97 @@ export class XmlEntityExpansionPass {
         }
         return { findings };
     }
+    methodRanges(types) {
+        const out = [];
+        for (const t of types ?? []) {
+            for (const m of t.methods ?? []) {
+                if (typeof m.start_line === 'number' && typeof m.end_line === 'number')
+                    out.push([m.start_line, m.end_line]);
+            }
+        }
+        return out;
+    }
+    /**
+     * In a file that DOES contain hardening evidence, is the factory created on
+     * `line` one that provably never receives it?
+     *
+     * Deliberately one-sided. It answers true for exactly two shapes:
+     *
+     *   1. CHAINED — `Factory.newInstance().newDocumentBuilder()`, where the
+     *      product is not handed on or returned either.
+     *   2. LOCAL — `Factory f = Factory.newInstance();` where the enclosing method
+     *      builds a parser from `f`, never hands `f` to another call, and never
+     *      returns it.
+     *
+     * and in both only when the enclosing method contains NO hardening-capable
+     * setter on ANY receiver, since hardening may land on the factory's product
+     * (`parser.getXMLReader().setFeature(…)`) rather than the factory.
+     *
+     * Every other shape — a field, a helper that takes the factory, a caller that
+     * receives it — may be hardened somewhere this check cannot see, so it keeps
+     * the previous file-level silence.
+     *
+     * A TransformerFactory additionally needs a `StreamSource` in its method: that
+     * is the input the transformer parses with its OWN parser. Fed a `DOMSource`
+     * it parses nothing, and fed a `SAXSource` it uses the reader it was given —
+     * whose hardening is that reader's business, not this factory's.
+     */
+    isProvablyUnhardened(lines, line, methodRanges, api) {
+        // Innermost enclosing method; without one the factory's reach is unknown.
+        let range = null;
+        for (const r of methodRanges) {
+            if (line < r[0] || line > r[1])
+                continue;
+            if (!range || r[1] - r[0] < range[1] - range[0])
+                range = r;
+        }
+        if (!range)
+            return false;
+        // The creating statement, joined to its `;` — `newInstance(` is often broken
+        // across lines after the opening parenthesis.
+        let decl = '';
+        let declEnd = line;
+        for (; declEnd <= Math.min(line + 3, range[1]); declEnd++) {
+            decl += ' ' + (lines[declEnd - 1] ?? '').trim();
+            if (decl.includes(';'))
+                break;
+        }
+        const body = lines.slice(line - 1, range[1]).join('\n');
+        if (api === 'TransformerFactory' && !/\bnew\s+StreamSource\s*\(/.test(body))
+            return false;
+        // Hardening need not land on the factory: `parser.getXMLReader().setFeature(…)`
+        // and `parser.setProperty(…)` harden its PRODUCT. So a method containing any
+        // hardening-capable setter, on any receiver, is not provable either way.
+        if (JAVA_HARDENING_SETTER_RE.test(body))
+            return false;
+        const chained = JAVA_FACTORY_CHAINED_RE.exec(decl);
+        if (chained) {
+            // The product may still be handed to a helper that hardens it.
+            const prod = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=/.exec(decl);
+            if (!prod)
+                return true;
+            const pn = prod[1].replace(/\$/g, '\\$');
+            const after = lines.slice(declEnd, range[1]).join('\n');
+            return !new RegExp(`[(,]\\s*${pn}\\s*[,)]|\\breturn\\s+${pn}\\s*;`).test(after);
+        }
+        // `Type name = …newInstance(…);` — a declaration ending the statement, so
+        // `name` is a local bound to the factory itself and not to a chained result.
+        const m = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.]*\bnewInstance\s*\([^()]*\)\s*;/.exec(decl);
+        if (!m)
+            return false;
+        const name = m[1].replace(/\$/g, '\\$');
+        const rest = lines.slice(declEnd, range[1]).join('\n');
+        // Only a factory that goes on to build a parser matters; one created to
+        // inspect (`factory.getClass()`) and dropped parses nothing.
+        const builds = new RegExp(`\\b${name}\\s*\\.\\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\\s*\\(`);
+        if (!builds.test(rest))
+            return false;
+        // Passed to another call (`harden(dbf)`, `x.configure(a, dbf)`) or returned.
+        const escapes = new RegExp(`[(,]\\s*${name}\\s*[,)]|\\breturn\\s+${name}\\s*;`);
+        if (escapes.test(rest))
+            return false;
+        return true;
+    }
     detectJavaCall(call) {
         if (call.method_name !== 'newInstance')
             return null;
@@ -160,7 +286,7 @@ export class XmlEntityExpansionPass {
                 return {
                     pattern: `${factory}.newInstance()`,
                     api: factory,
-                    cwe: 'CWE-776',
+                    cwe: 'CWE-611',
                 };
             }
         }
@@ -175,7 +301,7 @@ export class XmlEntityExpansionPass {
             return {
                 pattern: `etree.${method}`,
                 api: `lxml.etree.${method}`,
-                cwe: 'CWE-776',
+                cwe: 'CWE-611',
             };
         }
         // xml.etree.ElementTree.parse / fromstring

package/dist/analysis/passes/xml-entity-expansion-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"xml-entity-expansion-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAKH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,kBAAkB;IAClB,wBAAwB;IACxB,iBAAiB;IACjB,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH,wEAAwE;AACxE,0EAA0E;AAC1E,+CAA+C;AAC/C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,MAAM,qBAAqB,GACzB,gaAAga,CAAC;AAEna,+CAA+C;AAC/C,0DAA0D;AAC1D,8DAA8D;AAC9D,8DAA8D;AAC9D,MAAM,uBAAuB,GAC3B,yCAAyC,CAAC;AAC5C,MAAM,uBAAuB,GAC3B,qDAAqD,CAAC;AAExD,sCAAsC;AACtC,sEAAsE;AACtE,2DAA2D;AAC3D,MAAM,gCAAgC,GAAG,4BAA4B,CAAC;AACtE,MAAM,yBAAyB,GAC7B,+CAA+C,CAAC;AAElD,MAAM,kCAAkC,GAAG,kCAAkC,CAAC;AAiB9E,MAAM,OAAO,sBAAsB;IAGxB,IAAI,GAAG,sBAAsB,CAAC;IAC9B,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAyC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAE5B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAEpC,iEAAiE;YACjE,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,eAAe,GACnB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,0BAA0B,GAC9B,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC3C,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAExC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,oEAAoE;gBACpE,IAAI,GAAG,CAAC,GAAG,KAAK,oBAAoB,IAAI,eAAe;oBAAE,SAAS;gBAClE,IAAI,GAAG,CAAC,GAAG,KAAK,wBAAwB,IAAI,0BAA0B;oBACpE,SAAS;gBACX,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO,EACL,GAAG,GAAG,CAAC,GAAG,mDAAmD;wBAC7D,uDAAuD;wBACvD,uDAAuD;wBACvD,6DAA6D;wBAC7D,4DAA4D;wBAC5D,UAAU;oBACZ,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC7B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO,EACL,GAAG,GAAG,CAAC,GAAG,oDAAoD;wBAC9D,0DAA0D;wBAC1D,iEAAiE;wBACjE,iDAAiD;oBACnD,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC/B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,cAAc,CAAC,IAAc;QACnC,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,IAAI,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;gBACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,GAAG,OAAO,gBAAgB;oBACnC,GAAG,EAAE,OAAO;oBACZ,GAAG,EAAE,SAAS;iBACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,2CAA2C;QAC3C,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,KAAK,CAAC;YACnE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,SAAS,MAAM,EAAE;gBAC1B,GAAG,EAAE,cAAc,MAAM,EAAE;gBAC3B,GAAG,EAAE,SAAS;aACf,CAAC;QACJ,CAAC;QACD,2CAA2C;QAC3C,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,CAAC;YAC/C,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,aAAa;gBACvC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,eAAe,MAAM,EAAE;gBAChC,GAAG,EAAE,yBAAyB,MAAM,EAAE;gBACtC,GAAG,EAAE,SAAS;aACf,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YAC/B,OAAO,CACL,2DAA2D;gBAC3D,qCAAqC;gBACrC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YACrC,OAAO,CACL,2DAA2D;gBAC3D,qCAAqC;gBACrC,oDAAoD;gBACpD,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,OAAO,CACL,iEAAiE;gBACjE,kEAAkE;gBAClE,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,CACL,sEAAsE;YACtE,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,CACL,2BAA2B;gBAC3B,mEAAmE;gBACnE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,CACL,uEAAuE;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"xml-entity-expansion-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,kBAAkB;IAClB,wBAAwB;IACxB,iBAAiB;IACjB,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH,wEAAwE;AACxE,0EAA0E;AAC1E,+CAA+C;AAC/C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,MAAM,qBAAqB,GACzB,gaAAga,CAAC;AAEna,+CAA+C;AAC/C,0DAA0D;AAC1D,8DAA8D;AAC9D,8DAA8D;AAC9D,MAAM,uBAAuB,GAC3B,yCAAyC,CAAC;AAC5C,MAAM,uBAAuB,GAC3B,qDAAqD,CAAC;AAExD,sCAAsC;AACtC,sEAAsE;AACtE,2DAA2D;AAC3D,MAAM,gCAAgC,GAAG,4BAA4B,CAAC;AACtE,MAAM,yBAAyB,GAC7B,+CAA+C,CAAC;AAElD,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,MAAM,wBAAwB,GAC5B,8FAA8F,CAAC;AAEjG,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,uBAAuB,GAC3B,6JAA6J,CAAC;AAEhK,MAAM,kCAAkC,GAAG,kCAAkC,CAAC;AAiB9E,MAAM,OAAO,sBAAsB;IAGxB,IAAI,GAAG,sBAAsB,CAAC;IAC9B,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAyC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAE5B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,qEAAqE;YACrE,sEAAsE;YACtE,8DAA8D;YAC9D,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,WAAW,GAAG,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAEzE,iEAAiE;YACjE,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,eAAe,GACnB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,0BAA0B,GAC9B,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC3C,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAExC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,oEAAoE;gBACpE,IAAI,GAAG,CAAC,GAAG,KAAK,oBAAoB,IAAI,eAAe;oBAAE,SAAS;gBAClE,IAAI,GAAG,CAAC,GAAG,KAAK,wBAAwB,IAAI,0BAA0B;oBACpE,SAAS;gBACX,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,IAAI,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC/F,SAAS;gBACX,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO,EACL,GAAG,GAAG,CAAC,GAAG,mDAAmD;wBAC7D,uDAAuD;wBACvD,uDAAuD;wBACvD,6DAA6D;wBAC7D,4DAA4D;wBAC5D,UAAU;oBACZ,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC7B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO,EACL,GAAG,GAAG,CAAC,GAAG,oDAAoD;wBAC9D,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS;4BACpB,CAAC,CAAC,+DAA+D;gCAC/D,mCAAmC;4BACrC,CAAC,CAAC,uDAAuD,CAAC;wBAC5D,2BAA2B;wBAC3B,iDAAiD;oBACnD,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC/B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY,CAAC,KAA6B;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBACpE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,oBAAoB,CAC1B,KAAe,EACf,IAAY,EACZ,YAAqC,EACrC,GAAW;QAEX,0EAA0E;QAC1E,IAAI,KAAK,GAA4B,IAAI,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACzC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,6EAA6E;QAC7E,8CAA8C;QAC9C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,OAAO,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC1D,IAAI,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM;QAChC,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,oBAAoB,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;YACzE,OAAO,KAAK,CAAC;QAEf,gFAAgF;QAChF,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,+DAA+D;YAC/D,MAAM,IAAI,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,CAAC,GAAG,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,MAAM,IAAI,wIAAwI,CACnJ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,6EAA6E;QAC7E,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,WAAW,IAAI,yBAAyB,IAAI,OAAO,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAc;QACnC,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,IAAI,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;gBACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,GAAG,OAAO,gBAAgB;oBACnC,GAAG,EAAE,OAAO;oBACZ,GAAG,EAAE,SAAS;iBACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,2CAA2C;QAC3C,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,KAAK,CAAC;YACnE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,SAAS,MAAM,EAAE;gBAC1B,GAAG,EAAE,cAAc,MAAM,EAAE;gBAC3B,GAAG,EAAE,SAAS;aACf,CAAC;QACJ,CAAC;QACD,2CAA2C;QAC3C,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,CAAC;YAC/C,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,aAAa;gBACvC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,eAAe,MAAM,EAAE;gBAChC,GAAG,EAAE,yBAAyB,MAAM,EAAE;gBACtC,GAAG,EAAE,SAAS;aACf,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YAC/B,OAAO,CACL,2DAA2D;gBAC3D,qCAAqC;gBACrC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YACrC,OAAO,CACL,2DAA2D;gBAC3D,qCAAqC;gBACrC,oDAAoD;gBACpD,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,OAAO,CACL,iEAAiE;gBACjE,kEAAkE;gBAClE,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,CACL,sEAAsE;YACtE,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,CACL,2BAA2B;gBAC3B,mEAAmE;gBACnE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,CACL,uEAAuE;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/browser/circle-ir.js

@@ -26446,16 +26446,21 @@ var CSharpPlugin = class extends BaseLanguagePlugin {
 };
 
 // src/languages/plugins/index.ts
+function createBuiltinPlugins() {
+  return [
+    new JavaPlugin(),
+    new JavaScriptPlugin(),
+    new PythonPlugin(),
+    new RustPlugin(),
+    new BashPlugin(),
+    new HtmlPlugin(),
+    new VuePlugin(),
+    new GoPlugin(),
+    new CSharpPlugin()
+  ];
+}
 function registerBuiltinPlugins() {
-  registerLanguage(new JavaPlugin());
-  registerLanguage(new JavaScriptPlugin());
-  registerLanguage(new PythonPlugin());
-  registerLanguage(new RustPlugin());
-  registerLanguage(new BashPlugin());
-  registerLanguage(new HtmlPlugin());
-  registerLanguage(new VuePlugin());
-  registerLanguage(new GoPlugin());
-  registerLanguage(new CSharpPlugin());
+  for (const plugin of createBuiltinPlugins()) registerLanguage(plugin);
 }
 
 // src/analysis/html/html-extractor.ts
@@ -46241,6 +46246,8 @@ var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
 var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
 var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
 var JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
+var JAVA_HARDENING_SETTER_RE = /\.\s*(?:setFeature|setAttribute|setProperty|setXIncludeAware|setExpandEntityReferences)\s*\(/;
+var JAVA_FACTORY_CHAINED_RE = /\bnewInstance\s*\([^()]*\)\s*\.\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\s*\(/;
 var PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 var XmlEntityExpansionPass = class {
   name = "xml-entity-expansion";
@@ -46252,7 +46259,9 @@ var XmlEntityExpansionPass = class {
     const code = ctx.code ?? "";
     if (language === "java") {
       const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
-      if (safeInFile) return { findings };
+      const processWide = safeInFile && /jdk\.xml\./.test(code);
+      const lines = safeInFile ? code.split("\n") : [];
+      const methodRanges = safeInFile ? this.methodRanges(graph.ir.types) : [];
       const isXmlOutputOnly = JAVA_XML_OUTPUT_ONLY_RE.test(code) && !JAVA_XML_PARSE_INPUT_RE.test(code);
       const isDocumentBuilderEmptyOnly = JAVA_DOC_BUILDER_NEW_DOCUMENT_RE.test(code) && !JAVA_DOC_BUILDER_PARSE_RE.test(code);
       for (const call of graph.ir.calls) {
@@ -46262,6 +46271,8 @@ var XmlEntityExpansionPass = class {
         if (det.api === "DocumentBuilderFactory" && isDocumentBuilderEmptyOnly)
           continue;
         const line = call.location.line;
+        if (safeInFile && (processWide || !this.isProvablyUnhardened(lines, line, methodRanges, det.api)))
+          continue;
         findings.push({ line, language, ...det });
         ctx.addFinding({
           id: `${this.name}-${file}-${line}-${det.api}`,
@@ -46271,11 +46282,11 @@ var XmlEntityExpansionPass = class {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} created without disabling DTD / external-entity processing. Vulnerable to billion-laughs / quadratic blow-up DoS (CWE-776) and external-entity disclosure (CWE-611). Add \`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)\` (or the equivalent) before parsing.`,
+          message: `${det.api} created without disabling DTD / external-entity processing. Vulnerable to external-entity disclosure (CWE-611) and billion-laughs / quadratic blow-up DoS (CWE-776). Add \`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)\` (or the equivalent) before parsing.`,
           file,
           line,
           fix: this.fixForJava(det.api),
-          evidence: { ...det, language, safeFeatureInFile: false }
+          evidence: { ...det, language, safeFeatureInFile: safeInFile }
         });
       }
       return { findings };
@@ -46296,7 +46307,7 @@ var XmlEntityExpansionPass = class {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} called without an entity-safe parser. Vulnerable to billion-laughs / quadratic blow-up DoS (CWE-776) and external-entity disclosure (CWE-611). Use \`defusedxml\` or pass an \`XMLParser(resolve_entities=False)\` to lxml.`,
+          message: `${det.api} called without an entity-safe parser. Vulnerable ` + (det.cwe === "CWE-611" ? "to external-entity disclosure (CWE-611) and billion-laughs / quadratic blow-up DoS (CWE-776). " : "to billion-laughs / quadratic blow-up DoS (CWE-776). ") + "Use `defusedxml` or pass an `XMLParser(resolve_entities=False)` to lxml.",
           file,
           line,
           fix: this.fixForPython(det.api),
@@ -46307,6 +46318,78 @@ var XmlEntityExpansionPass = class {
     }
     return { findings };
   }
+  methodRanges(types) {
+    const out2 = [];
+    for (const t of types ?? []) {
+      for (const m of t.methods ?? []) {
+        if (typeof m.start_line === "number" && typeof m.end_line === "number")
+          out2.push([m.start_line, m.end_line]);
+      }
+    }
+    return out2;
+  }
+  /**
+   * In a file that DOES contain hardening evidence, is the factory created on
+   * `line` one that provably never receives it?
+   *
+   * Deliberately one-sided. It answers true for exactly two shapes:
+   *
+   *   1. CHAINED — `Factory.newInstance().newDocumentBuilder()`, where the
+   *      product is not handed on or returned either.
+   *   2. LOCAL — `Factory f = Factory.newInstance();` where the enclosing method
+   *      builds a parser from `f`, never hands `f` to another call, and never
+   *      returns it.
+   *
+   * and in both only when the enclosing method contains NO hardening-capable
+   * setter on ANY receiver, since hardening may land on the factory's product
+   * (`parser.getXMLReader().setFeature(…)`) rather than the factory.
+   *
+   * Every other shape — a field, a helper that takes the factory, a caller that
+   * receives it — may be hardened somewhere this check cannot see, so it keeps
+   * the previous file-level silence.
+   *
+   * A TransformerFactory additionally needs a `StreamSource` in its method: that
+   * is the input the transformer parses with its OWN parser. Fed a `DOMSource`
+   * it parses nothing, and fed a `SAXSource` it uses the reader it was given —
+   * whose hardening is that reader's business, not this factory's.
+   */
+  isProvablyUnhardened(lines, line, methodRanges, api) {
+    let range = null;
+    for (const r of methodRanges) {
+      if (line < r[0] || line > r[1]) continue;
+      if (!range || r[1] - r[0] < range[1] - range[0]) range = r;
+    }
+    if (!range) return false;
+    let decl = "";
+    let declEnd = line;
+    for (; declEnd <= Math.min(line + 3, range[1]); declEnd++) {
+      decl += " " + (lines[declEnd - 1] ?? "").trim();
+      if (decl.includes(";")) break;
+    }
+    const body2 = lines.slice(line - 1, range[1]).join("\n");
+    if (api === "TransformerFactory" && !/\bnew\s+StreamSource\s*\(/.test(body2))
+      return false;
+    if (JAVA_HARDENING_SETTER_RE.test(body2)) return false;
+    const chained = JAVA_FACTORY_CHAINED_RE.exec(decl);
+    if (chained) {
+      const prod = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=/.exec(decl);
+      if (!prod) return true;
+      const pn = prod[1].replace(/\$/g, "\\$");
+      const after = lines.slice(declEnd, range[1]).join("\n");
+      return !new RegExp(`[(,]\\s*${pn}\\s*[,)]|\\breturn\\s+${pn}\\s*;`).test(after);
+    }
+    const m = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.]*\bnewInstance\s*\([^()]*\)\s*;/.exec(decl);
+    if (!m) return false;
+    const name2 = m[1].replace(/\$/g, "\\$");
+    const rest = lines.slice(declEnd, range[1]).join("\n");
+    const builds = new RegExp(
+      `\\b${name2}\\s*\\.\\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\\s*\\(`
+    );
+    if (!builds.test(rest)) return false;
+    const escapes = new RegExp(`[(,]\\s*${name2}\\s*[,)]|\\breturn\\s+${name2}\\s*;`);
+    if (escapes.test(rest)) return false;
+    return true;
+  }
   detectJavaCall(call) {
     if (call.method_name !== "newInstance") return null;
     const recv = call.receiver ?? "";
@@ -46316,7 +46399,7 @@ var XmlEntityExpansionPass = class {
         return {
           pattern: `${factory}.newInstance()`,
           api: factory,
-          cwe: "CWE-776"
+          cwe: "CWE-611"
         };
       }
     }
@@ -46329,7 +46412,7 @@ var XmlEntityExpansionPass = class {
       return {
         pattern: `etree.${method}`,
         api: `lxml.etree.${method}`,
-        cwe: "CWE-776"
+        cwe: "CWE-611"
       };
     }
     if ((method === "parse" || method === "fromstring") && (recv === "ET" || recv === "ElementTree" || recv.endsWith(".ElementTree"))) {

package/dist/index.d.ts

@@ -12,6 +12,7 @@ export type { UnboundedCollectionOptions } from './analysis/passes/unbounded-col
 export type { PassOptions } from './analyzer.js';
 export type { CircleIR, Meta, TypeInfo, MethodInfo, ParameterInfo, FieldInfo, CallInfo, ArgumentInfo, CallResolution, CFG, CFGBlock, CFGEdge, DFG, DFGDef, DFGUse, DFGChain, Taint, TaintSource, TaintSink, TaintSanitizer, ImportInfo, ExportInfo, UnresolvedItem, Enriched, EnrichedFunction, ResolvedCall, Finding, TaintHop, Vulnerability, AnalysisResponse, SourceType, SinkType, Severity, ProjectShape, ProjectEnv, ProjectProfile, ProjectProfileSummary, PassCategory, SarifLevel, SastFinding, MetricCategory, MetricValue, FileMetrics, ProjectAnalysis, ProjectMeta, FileAnalysis, TypeHierarchy, ClassHierarchyInfo, InterfaceHierarchyInfo, CrossFileCall, ArgMapping, TaintPath, } from './types/index.js';
 export { SOURCE_TYPES, SINK_TYPES } from './types/index.js';
+export { getModelledCwes, isModelledCwe, RELATED_CWE, type ModelledCwes, } from './analysis/modelled-cwes.js';
 export type { SourceConfig, SinkConfig, TaintConfig, SourcePattern, SinkPattern, SanitizerPattern, } from './types/config.js';
 export { initParser, parse, walkTree, findNodes, findAncestor, getNodeText, collectAllNodes, type SupportedLanguage, type SyntaxNode, type Node, type NodeCache, type Tree, } from './core/index.js';
 export { extractMeta, extractTypes, extractCalls, extractImports, extractExports, buildCFG, buildDFG, } from './core/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,UAAU,EACV,SAAS,EACT,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,YAAY,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,YAAY,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,YAAY,EAEV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,GAAG,EACH,QAAQ,EACR,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,KAAK,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,UAAU,EACV,UAAU,EACV,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,gBAAgB,EAGhB,UAAU,EACV,QAAQ,EACR,QAAQ,EAGR,YAAY,EACZ,UAAU,EACV,cAAc,EACd,qBAAqB,EAGrB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,EACd,WAAW,EACX,WAAW,EAGX,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG5D,YAAY,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,IAAI,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAGxF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,UAAU,EACV,SAAS,EACT,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,YAAY,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,YAAY,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,YAAY,EAEV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,GAAG,EACH,QAAQ,EACR,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,KAAK,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,UAAU,EACV,UAAU,EACV,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,gBAAgB,EAGhB,UAAU,EACV,QAAQ,EACR,QAAQ,EAGR,YAAY,EACZ,UAAU,EACV,cAAc,EACd,qBAAqB,EAGrB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,EACd,WAAW,EACX,WAAW,EAGX,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI5D,OAAO,EACL,eAAe,EACf,aAAa,EACb,WAAW,EACX,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAC;AAGrC,YAAY,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,IAAI,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAGxF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -16,6 +16,9 @@ export { parseNpmDependencies, parseNpmLockDependencies, parsePypiDependencies,
 // an unmatched value fails a test on their side rather than falling through
 // to a default branch. Locked by tests/public-entry-exports.test.ts.
 export { SOURCE_TYPES, SINK_TYPES } from './types/index.js';
+// Modelled-CWE export (#393) — which weakness classes the taint engine covers,
+// derived from the live sink registries.
+export { getModelledCwes, isModelledCwe, RELATED_CWE, } from './analysis/modelled-cwes.js';
 // Core utilities (for advanced usage)
 export { initParser, parse, walkTree, findNodes, findAncestor, getNodeText, collectAllNodes, } from './core/index.js';
 // Core extractors

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GAEd,MAAM,eAAe,CAAC;AAEvB,4EAA4E;AAC5E,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AA+E5B,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAY5D,sCAAsC;AACtC,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,GAMnB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iCAAiC,CAAC;AAExF,uBAAuB;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAY9B,gCAAgC;AAChC,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GAEd,MAAM,eAAe,CAAC;AAEvB,4EAA4E;AAC5E,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AA+E5B,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE5D,+EAA+E;AAC/E,yCAAyC;AACzC,OAAO,EACL,eAAe,EACf,aAAa,EACb,WAAW,GAEZ,MAAM,6BAA6B,CAAC;AAYrC,sCAAsC;AACtC,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,GAMnB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iCAAiC,CAAC;AAExF,uBAAuB;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAY9B,gCAAgC;AAChC,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,mBAAmB,CAAC"}

package/dist/languages/plugins/index.d.ts

@@ -12,6 +12,14 @@ export { HtmlPlugin } from './html.js';
 export { VuePlugin } from './vue.js';
 export { GoPlugin } from './go.js';
 export { CSharpPlugin } from './csharp.js';
+import type { LanguagePlugin } from '../types.js';
+/**
+ * Fresh instances of every built-in language plugin, unregistered. The single
+ * list both `registerBuiltinPlugins` and registry-wide enumerations (e.g. the
+ * modelled-CWE export) read, so a new plugin cannot be added to one and missed
+ * by the other.
+ */
+export declare function createBuiltinPlugins(): LanguagePlugin[];
 /**
  * Register all built-in language plugins with the global registry.
  * Call this during analyzer initialization.

package/dist/languages/plugins/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAa3C;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAU7C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAWlD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,EAAE,CAYvD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/dist/languages/plugins/index.js

@@ -22,19 +22,31 @@ import { HtmlPlugin } from './html.js';
 import { VuePlugin } from './vue.js';
 import { GoPlugin } from './go.js';
 import { CSharpPlugin } from './csharp.js';
+/**
+ * Fresh instances of every built-in language plugin, unregistered. The single
+ * list both `registerBuiltinPlugins` and registry-wide enumerations (e.g. the
+ * modelled-CWE export) read, so a new plugin cannot be added to one and missed
+ * by the other.
+ */
+export function createBuiltinPlugins() {
+    return [
+        new JavaPlugin(),
+        new JavaScriptPlugin(),
+        new PythonPlugin(),
+        new RustPlugin(),
+        new BashPlugin(),
+        new HtmlPlugin(),
+        new VuePlugin(),
+        new GoPlugin(),
+        new CSharpPlugin(),
+    ];
+}
 /**
  * Register all built-in language plugins with the global registry.
  * Call this during analyzer initialization.
  */
 export function registerBuiltinPlugins() {
-    registerLanguage(new JavaPlugin());
-    registerLanguage(new JavaScriptPlugin());
-    registerLanguage(new PythonPlugin());
-    registerLanguage(new RustPlugin());
-    registerLanguage(new BashPlugin());
-    registerLanguage(new HtmlPlugin());
-    registerLanguage(new VuePlugin());
-    registerLanguage(new GoPlugin());
-    registerLanguage(new CSharpPlugin());
+    for (const plugin of createBuiltinPlugins())
+        registerLanguage(plugin);
 }
 //# sourceMappingURL=index.js.map

package/dist/languages/plugins/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/languages/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;IACrC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;IAClC,gBAAgB,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IACjC,gBAAgB,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/languages/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,IAAI,UAAU,EAAE;QAChB,IAAI,gBAAgB,EAAE;QACtB,IAAI,YAAY,EAAE;QAClB,IAAI,UAAU,EAAE;QAChB,IAAI,UAAU,EAAE;QAChB,IAAI,UAAU,EAAE;QAChB,IAAI,SAAS,EAAE;QACf,IAAI,QAAQ,EAAE;QACd,IAAI,YAAY,EAAE;KACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE;QAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "4.9.21",
+  "version": "4.9.22",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",