circle-ir 4.9.21 → 4.9.23

package/dist/analysis/passes/xml-entity-expansion-pass.d.ts

@@ -1,5 +1,5 @@
 /**
- * Pass: xml-entity-expansion (CWE-776 / CWE-611, category: security)
+ * Pass: xml-entity-expansion (CWE-611 / CWE-776, category: security)
  *
  * Pattern pass — flags XML parser instantiation that does *not* disable
  * DTD / external-entity processing in the same file. This covers:
@@ -14,8 +14,11 @@
  *     - `XMLInputFactory.newInstance()` (StAX)
  *     - `SchemaFactory.newInstance(...)`
  *     - `TransformerFactory.newInstance()`
- *   Safe-feature setters (any of these in the same file silences the
- *   finding for that factory class):
+ *   Safe-feature setters. Any of these in the file silences a factory
+ *   UNLESS that factory is a local variable which provably never receives
+ *   one (no hardening-capable setter on it in its method, never passed to
+ *   another call, never returned) — so one hardened factory no longer masks
+ *   an unhardened one beside it:
  *     - `setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`
  *     - `setFeature("http://xml.org/sax/features/external-general-entities", false)`
  *     - `setFeature("http://xml.org/sax/features/external-parameter-entities", false)`
@@ -35,6 +38,19 @@
  * because billion-laughs is exploitable via any attacker-supplied entity
  * file even when the parse() argument itself is trusted.
  *
+ * CWE is assigned PER API, by which weakness the unhardened default actually
+ * leaves open (#426) — the same per-API reasoning `language-sources-pass`
+ * applies to Python's `xml.sax`:
+ *   - Java JAXP factories  -> CWE-611. External entity resolution is ON by
+ *     default, while JAXP has shipped a default entity-expansion limit for
+ *     years, so the live risk on a current JDK is external entities. Every
+ *     hardening token this pass looks for is an external-entity control.
+ *   - `lxml.etree`         -> CWE-611. `resolve_entities` defaults on.
+ *   - `xml.etree.ElementTree` -> CWE-776. It never resolves external entities;
+ *     what remains is entity expansion.
+ * The JS variant of this rule (`libxmljs` `noent: true`) already reported
+ * CWE-611, so before this the rule disagreed with itself across languages.
+ *
  * Issue: #86, Sprint 6.
  */
 import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
@@ -50,6 +66,33 @@ export declare class XmlEntityExpansionPass implements AnalysisPass<XmlEntityExp
     readonly name = "xml-entity-expansion";
     readonly category: 'security';
     run(ctx: PassContext): XmlEntityExpansionResult;
+    private methodRanges;
+    /**
+     * In a file that DOES contain hardening evidence, is the factory created on
+     * `line` one that provably never receives it?
+     *
+     * Deliberately one-sided. It answers true for exactly two shapes:
+     *
+     *   1. CHAINED — `Factory.newInstance().newDocumentBuilder()`, where the
+     *      product is not handed on or returned either.
+     *   2. LOCAL — `Factory f = Factory.newInstance();` where the enclosing method
+     *      builds a parser from `f`, never hands `f` to another call, and never
+     *      returns it.
+     *
+     * and in both only when the enclosing method contains NO hardening-capable
+     * setter on ANY receiver, since hardening may land on the factory's product
+     * (`parser.getXMLReader().setFeature(…)`) rather than the factory.
+     *
+     * Every other shape — a field, a helper that takes the factory, a caller that
+     * receives it — may be hardened somewhere this check cannot see, so it keeps
+     * the previous file-level silence.
+     *
+     * A TransformerFactory additionally needs a `StreamSource` in its method: that
+     * is the input the transformer parses with its OWN parser. Fed a `DOMSource`
+     * it parses nothing, and fed a `SAXSource` it uses the reader it was given —
+     * whose hardening is that reader's business, not this factory's.
+     */
+    private isProvablyUnhardened;
     private detectJavaCall;
     private detectPythonCall;
     private fixForJava;

package/dist/analysis/passes/xml-entity-expansion-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xml-entity-expansion-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA6C9E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,sBACX,YAAW,YAAY,CAAC,wBAAwB,CAAC;IAEjD,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB,CAsF9C;IAED,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,UAAU;IA6BlB,OAAO,CAAC,YAAY;CAarB"}
+{"version":3,"file":"xml-entity-expansion-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAwD9E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,sBACX,YAAW,YAAY,CAAC,wBAAwB,CAAC;IAEjD,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB,CAmG9C;IAED,OAAO,CAAC,YAAY;IAWpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,OAAO,CAAC,oBAAoB;IA0D5B,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,UAAU;IA6BlB,OAAO,CAAC,YAAY;CAarB"}

package/dist/analysis/passes/xml-entity-expansion-pass.js

@@ -1,5 +1,5 @@
 /**
- * Pass: xml-entity-expansion (CWE-776 / CWE-611, category: security)
+ * Pass: xml-entity-expansion (CWE-611 / CWE-776, category: security)
  *
  * Pattern pass — flags XML parser instantiation that does *not* disable
  * DTD / external-entity processing in the same file. This covers:
@@ -14,8 +14,11 @@
  *     - `XMLInputFactory.newInstance()` (StAX)
  *     - `SchemaFactory.newInstance(...)`
  *     - `TransformerFactory.newInstance()`
- *   Safe-feature setters (any of these in the same file silences the
- *   finding for that factory class):
+ *   Safe-feature setters. Any of these in the file silences a factory
+ *   UNLESS that factory is a local variable which provably never receives
+ *   one (no hardening-capable setter on it in its method, never passed to
+ *   another call, never returned) — so one hardened factory no longer masks
+ *   an unhardened one beside it:
  *     - `setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`
  *     - `setFeature("http://xml.org/sax/features/external-general-entities", false)`
  *     - `setFeature("http://xml.org/sax/features/external-parameter-entities", false)`
@@ -35,6 +38,19 @@
  * because billion-laughs is exploitable via any attacker-supplied entity
  * file even when the parse() argument itself is trusted.
  *
+ * CWE is assigned PER API, by which weakness the unhardened default actually
+ * leaves open (#426) — the same per-API reasoning `language-sources-pass`
+ * applies to Python's `xml.sax`:
+ *   - Java JAXP factories  -> CWE-611. External entity resolution is ON by
+ *     default, while JAXP has shipped a default entity-expansion limit for
+ *     years, so the live risk on a current JDK is external entities. Every
+ *     hardening token this pass looks for is an external-entity control.
+ *   - `lxml.etree`         -> CWE-611. `resolve_entities` defaults on.
+ *   - `xml.etree.ElementTree` -> CWE-776. It never resolves external entities;
+ *     what remains is entity expansion.
+ * The JS variant of this rule (`libxmljs` `noent: true`) already reported
+ * CWE-611, so before this the rule disagreed with itself across languages.
+ *
  * Issue: #86, Sprint 6.
  */
 const JAVA_FACTORIES = new Set([
@@ -63,6 +79,13 @@ const JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\
 //   - file calls NO builder.parse(...) (never reads bytes)
 const JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
 const JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
+// Any call that CAN carry XML hardening, on any receiver — factory, parser,
+// reader, validator or transformer. Matched by name, not argument, because the
+// feature string is routinely a constant declared elsewhere.
+const JAVA_HARDENING_SETTER_RE = /\.\s*(?:setFeature|setAttribute|setProperty|setXIncludeAware|setExpandEntityReferences)\s*\(/;
+// A factory consumed in the same expression that creates it — never bound to a
+// name, so it can never be configured.
+const JAVA_FACTORY_CHAINED_RE = /\bnewInstance\s*\([^()]*\)\s*\.\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\s*\(/;
 const PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 export class XmlEntityExpansionPass {
     name = 'xml-entity-expansion';
@@ -74,8 +97,15 @@ export class XmlEntityExpansionPass {
         const code = ctx.code ?? '';
         if (language === 'java') {
             const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
-            if (safeInFile)
-                return { findings };
+            // Hardening evidence used to silence the WHOLE file, so one hardened
+            // factory masked every other factory beside it. When evidence exists,
+            // keep only the factories that provably never receive it (see
+            // `isProvablyUnhardened`); anything ambiguous stays silent, as before.
+            // `jdk.xml.*` limits are set process-wide (System.setProperty), so they
+            // reach every factory regardless of which variable the file touches.
+            const processWide = safeInFile && /jdk\.xml\./.test(code);
+            const lines = safeInFile ? code.split('\n') : [];
+            const methodRanges = safeInFile ? this.methodRanges(graph.ir.types) : [];
             // #173 — output-only TransformerFactory + empty DocumentBuilder.
             // File-level heuristics; conservative-bias (only suppress when the
             // file shows ONLY the safe shape and NO unsafe shape).
@@ -93,6 +123,8 @@ export class XmlEntityExpansionPass {
                 if (det.api === 'DocumentBuilderFactory' && isDocumentBuilderEmptyOnly)
                     continue;
                 const line = call.location.line;
+                if (safeInFile && (processWide || !this.isProvablyUnhardened(lines, line, methodRanges, det.api)))
+                    continue;
                 findings.push({ line, language, ...det });
                 ctx.addFinding({
                     id: `${this.name}-${file}-${line}-${det.api}`,
@@ -103,15 +135,15 @@ export class XmlEntityExpansionPass {
                     severity: 'high',
                     level: 'error',
                     message: `${det.api} created without disabling DTD / external-entity ` +
-                        'processing. Vulnerable to billion-laughs / quadratic ' +
-                        'blow-up DoS (CWE-776) and external-entity disclosure ' +
-                        '(CWE-611). Add `setFeature("http://apache.org/xml/features/' +
+                        'processing. Vulnerable to external-entity disclosure ' +
+                        '(CWE-611) and billion-laughs / quadratic blow-up DoS ' +
+                        '(CWE-776). Add `setFeature("http://apache.org/xml/features/' +
                         'disallow-doctype-decl", true)` (or the equivalent) before ' +
                         'parsing.',
                     file,
                     line,
                     fix: this.fixForJava(det.api),
-                    evidence: { ...det, language, safeFeatureInFile: false },
+                    evidence: { ...det, language, safeFeatureInFile: safeInFile },
                 });
             }
             return { findings };
@@ -136,8 +168,11 @@ export class XmlEntityExpansionPass {
                     severity: 'high',
                     level: 'error',
                     message: `${det.api} called without an entity-safe parser. Vulnerable ` +
-                        'to billion-laughs / quadratic blow-up DoS (CWE-776) and ' +
-                        'external-entity disclosure (CWE-611). Use `defusedxml` or pass ' +
+                        (det.cwe === 'CWE-611'
+                            ? 'to external-entity disclosure (CWE-611) and billion-laughs / ' +
+                                'quadratic blow-up DoS (CWE-776). '
+                            : 'to billion-laughs / quadratic blow-up DoS (CWE-776). ') +
+                        'Use `defusedxml` or pass ' +
                         'an `XMLParser(resolve_entities=False)` to lxml.',
                     file,
                     line,
@@ -149,6 +184,97 @@ export class XmlEntityExpansionPass {
         }
         return { findings };
     }
+    methodRanges(types) {
+        const out = [];
+        for (const t of types ?? []) {
+            for (const m of t.methods ?? []) {
+                if (typeof m.start_line === 'number' && typeof m.end_line === 'number')
+                    out.push([m.start_line, m.end_line]);
+            }
+        }
+        return out;
+    }
+    /**
+     * In a file that DOES contain hardening evidence, is the factory created on
+     * `line` one that provably never receives it?
+     *
+     * Deliberately one-sided. It answers true for exactly two shapes:
+     *
+     *   1. CHAINED — `Factory.newInstance().newDocumentBuilder()`, where the
+     *      product is not handed on or returned either.
+     *   2. LOCAL — `Factory f = Factory.newInstance();` where the enclosing method
+     *      builds a parser from `f`, never hands `f` to another call, and never
+     *      returns it.
+     *
+     * and in both only when the enclosing method contains NO hardening-capable
+     * setter on ANY receiver, since hardening may land on the factory's product
+     * (`parser.getXMLReader().setFeature(…)`) rather than the factory.
+     *
+     * Every other shape — a field, a helper that takes the factory, a caller that
+     * receives it — may be hardened somewhere this check cannot see, so it keeps
+     * the previous file-level silence.
+     *
+     * A TransformerFactory additionally needs a `StreamSource` in its method: that
+     * is the input the transformer parses with its OWN parser. Fed a `DOMSource`
+     * it parses nothing, and fed a `SAXSource` it uses the reader it was given —
+     * whose hardening is that reader's business, not this factory's.
+     */
+    isProvablyUnhardened(lines, line, methodRanges, api) {
+        // Innermost enclosing method; without one the factory's reach is unknown.
+        let range = null;
+        for (const r of methodRanges) {
+            if (line < r[0] || line > r[1])
+                continue;
+            if (!range || r[1] - r[0] < range[1] - range[0])
+                range = r;
+        }
+        if (!range)
+            return false;
+        // The creating statement, joined to its `;` — `newInstance(` is often broken
+        // across lines after the opening parenthesis.
+        let decl = '';
+        let declEnd = line;
+        for (; declEnd <= Math.min(line + 3, range[1]); declEnd++) {
+            decl += ' ' + (lines[declEnd - 1] ?? '').trim();
+            if (decl.includes(';'))
+                break;
+        }
+        const body = lines.slice(line - 1, range[1]).join('\n');
+        if (api === 'TransformerFactory' && !/\bnew\s+StreamSource\s*\(/.test(body))
+            return false;
+        // Hardening need not land on the factory: `parser.getXMLReader().setFeature(…)`
+        // and `parser.setProperty(…)` harden its PRODUCT. So a method containing any
+        // hardening-capable setter, on any receiver, is not provable either way.
+        if (JAVA_HARDENING_SETTER_RE.test(body))
+            return false;
+        const chained = JAVA_FACTORY_CHAINED_RE.exec(decl);
+        if (chained) {
+            // The product may still be handed to a helper that hardens it.
+            const prod = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=/.exec(decl);
+            if (!prod)
+                return true;
+            const pn = prod[1].replace(/\$/g, '\\$');
+            const after = lines.slice(declEnd, range[1]).join('\n');
+            return !new RegExp(`[(,]\\s*${pn}\\s*[,)]|\\breturn\\s+${pn}\\s*;`).test(after);
+        }
+        // `Type name = …newInstance(…);` — a declaration ending the statement, so
+        // `name` is a local bound to the factory itself and not to a chained result.
+        const m = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.]*\bnewInstance\s*\([^()]*\)\s*;/.exec(decl);
+        if (!m)
+            return false;
+        const name = m[1].replace(/\$/g, '\\$');
+        const rest = lines.slice(declEnd, range[1]).join('\n');
+        // Only a factory that goes on to build a parser matters; one created to
+        // inspect (`factory.getClass()`) and dropped parses nothing.
+        const builds = new RegExp(`\\b${name}\\s*\\.\\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\\s*\\(`);
+        if (!builds.test(rest))
+            return false;
+        // Passed to another call (`harden(dbf)`, `x.configure(a, dbf)`) or returned.
+        const escapes = new RegExp(`[(,]\\s*${name}\\s*[,)]|\\breturn\\s+${name}\\s*;`);
+        if (escapes.test(rest))
+            return false;
+        return true;
+    }
     detectJavaCall(call) {
         if (call.method_name !== 'newInstance')
             return null;
@@ -160,7 +286,7 @@ export class XmlEntityExpansionPass {
                 return {
                     pattern: `${factory}.newInstance()`,
                     api: factory,
-                    cwe: 'CWE-776',
+                    cwe: 'CWE-611',
                 };
             }
         }
@@ -175,7 +301,7 @@ export class XmlEntityExpansionPass {
             return {
                 pattern: `etree.${method}`,
                 api: `lxml.etree.${method}`,
-                cwe: 'CWE-776',
+                cwe: 'CWE-611',
             };
         }
         // xml.etree.ElementTree.parse / fromstring

package/dist/analysis/passes/xml-entity-expansion-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"xml-entity-expansion-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAKH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,kBAAkB;IAClB,wBAAwB;IACxB,iBAAiB;IACjB,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH,wEAAwE;AACxE,0EAA0E;AAC1E,+CAA+C;AAC/C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,MAAM,qBAAqB,GACzB,gaAAga,CAAC;AAEna,+CAA+C;AAC/C,0DAA0D;AAC1D,8DAA8D;AAC9D,8DAA8D;AAC9D,MAAM,uBAAuB,GAC3B,yCAAyC,CAAC;AAC5C,MAAM,uBAAuB,GAC3B,qDAAqD,CAAC;AAExD,sCAAsC;AACtC,sEAAsE;AACtE,2DAA2D;AAC3D,MAAM,gCAAgC,GAAG,4BAA4B,CAAC;AACtE,MAAM,yBAAyB,GAC7B,+CAA+C,CAAC;AAElD,MAAM,kCAAkC,GAAG,kCAAkC,CAAC;AAiB9E,MAAM,OAAO,sBAAsB;IAGxB,IAAI,GAAG,sBAAsB,CAAC;IAC9B,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAyC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAE5B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAEpC,iEAAiE;YACjE,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,eAAe,GACnB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,0BAA0B,GAC9B,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC3C,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAExC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,oEAAoE;gBACpE,IAAI,GAAG,CAAC,GAAG,KAAK,oBAAoB,IAAI,eAAe;oBAAE,SAAS;gBAClE,IAAI,GAAG,CAAC,GAAG,KAAK,wBAAwB,IAAI,0BAA0B;oBACpE,SAAS;gBACX,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO,EACL,GAAG,GAAG,CAAC,GAAG,mDAAmD;wBAC7D,uDAAuD;wBACvD,uDAAuD;wBACvD,6DAA6D;wBAC7D,4DAA4D;wBAC5D,UAAU;oBACZ,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC7B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO,EACL,GAAG,GAAG,CAAC,GAAG,oDAAoD;wBAC9D,0DAA0D;wBAC1D,iEAAiE;wBACjE,iDAAiD;oBACnD,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC/B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,cAAc,CAAC,IAAc;QACnC,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,IAAI,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;gBACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,GAAG,OAAO,gBAAgB;oBACnC,GAAG,EAAE,OAAO;oBACZ,GAAG,EAAE,SAAS;iBACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,2CAA2C;QAC3C,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,KAAK,CAAC;YACnE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,SAAS,MAAM,EAAE;gBAC1B,GAAG,EAAE,cAAc,MAAM,EAAE;gBAC3B,GAAG,EAAE,SAAS;aACf,CAAC;QACJ,CAAC;QACD,2CAA2C;QAC3C,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,CAAC;YAC/C,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,aAAa;gBACvC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,eAAe,MAAM,EAAE;gBAChC,GAAG,EAAE,yBAAyB,MAAM,EAAE;gBACtC,GAAG,EAAE,SAAS;aACf,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YAC/B,OAAO,CACL,2DAA2D;gBAC3D,qCAAqC;gBACrC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YACrC,OAAO,CACL,2DAA2D;gBAC3D,qCAAqC;gBACrC,oDAAoD;gBACpD,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,OAAO,CACL,iEAAiE;gBACjE,kEAAkE;gBAClE,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,CACL,sEAAsE;YACtE,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,CACL,2BAA2B;gBAC3B,mEAAmE;gBACnE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,CACL,uEAAuE;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"xml-entity-expansion-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/xml-entity-expansion-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAKH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,kBAAkB;IAClB,wBAAwB;IACxB,iBAAiB;IACjB,eAAe;IACf,oBAAoB;CACrB,CAAC,CAAC;AAEH,wEAAwE;AACxE,0EAA0E;AAC1E,+CAA+C;AAC/C,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,mEAAmE;AACnE,MAAM,qBAAqB,GACzB,gaAAga,CAAC;AAEna,+CAA+C;AAC/C,0DAA0D;AAC1D,8DAA8D;AAC9D,8DAA8D;AAC9D,MAAM,uBAAuB,GAC3B,yCAAyC,CAAC;AAC5C,MAAM,uBAAuB,GAC3B,qDAAqD,CAAC;AAExD,sCAAsC;AACtC,sEAAsE;AACtE,2DAA2D;AAC3D,MAAM,gCAAgC,GAAG,4BAA4B,CAAC;AACtE,MAAM,yBAAyB,GAC7B,+CAA+C,CAAC;AAElD,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,MAAM,wBAAwB,GAC5B,8FAA8F,CAAC;AAEjG,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,uBAAuB,GAC3B,6JAA6J,CAAC;AAEhK,MAAM,kCAAkC,GAAG,kCAAkC,CAAC;AAiB9E,MAAM,OAAO,sBAAsB;IAGxB,IAAI,GAAG,sBAAsB,CAAC;IAC9B,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAyC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAE5B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,qEAAqE;YACrE,sEAAsE;YACtE,8DAA8D;YAC9D,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,WAAW,GAAG,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAEzE,iEAAiE;YACjE,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,eAAe,GACnB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAClC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,0BAA0B,GAC9B,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC3C,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAExC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,oEAAoE;gBACpE,IAAI,GAAG,CAAC,GAAG,KAAK,oBAAoB,IAAI,eAAe;oBAAE,SAAS;gBAClE,IAAI,GAAG,CAAC,GAAG,KAAK,wBAAwB,IAAI,0BAA0B;oBACpE,SAAS;gBACX,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,IAAI,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC/F,SAAS;gBACX,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO,EACL,GAAG,GAAG,CAAC,GAAG,mDAAmD;wBAC7D,uDAAuD;wBACvD,uDAAuD;wBACvD,6DAA6D;wBAC7D,4DAA4D;wBAC5D,UAAU;oBACZ,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC7B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC9C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1C,GAAG,CAAC,UAAU,CAAC;oBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE;oBAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,OAAO;oBACd,OAAO,EACL,GAAG,GAAG,CAAC,GAAG,oDAAoD;wBAC9D,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS;4BACpB,CAAC,CAAC,+DAA+D;gCAC/D,mCAAmC;4BACrC,CAAC,CAAC,uDAAuD,CAAC;wBAC5D,2BAA2B;wBAC3B,iDAAiD;oBACnD,IAAI;oBACJ,IAAI;oBACJ,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAC/B,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,YAAY,CAAC,KAA6B;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBACpE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,oBAAoB,CAC1B,KAAe,EACf,IAAY,EACZ,YAAqC,EACrC,GAAW;QAEX,0EAA0E;QAC1E,IAAI,KAAK,GAA4B,IAAI,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACzC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,6EAA6E;QAC7E,8CAA8C;QAC9C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,OAAO,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC1D,IAAI,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM;QAChC,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,oBAAoB,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;YACzE,OAAO,KAAK,CAAC;QAEf,gFAAgF;QAChF,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtD,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,+DAA+D;YAC/D,MAAM,IAAI,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,CAAC,GAAG,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,MAAM,IAAI,wIAAwI,CACnJ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,6EAA6E;QAC7E,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,WAAW,IAAI,yBAAyB,IAAI,OAAO,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAc;QACnC,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,IAAI,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;gBACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO;oBACL,OAAO,EAAE,GAAG,OAAO,gBAAgB;oBACnC,GAAG,EAAE,OAAO;oBACZ,GAAG,EAAE,SAAS;iBACf,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,2CAA2C;QAC3C,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,KAAK,CAAC;YACnE,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO;gBACL,OAAO,EAAE,SAAS,MAAM,EAAE;gBAC1B,GAAG,EAAE,cAAc,MAAM,EAAE;gBAC3B,GAAG,EAAE,SAAS;aACf,CAAC;QACJ,CAAC;QACD,2CAA2C;QAC3C,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,CAAC;YAC/C,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,aAAa;gBACvC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,eAAe,MAAM,EAAE;gBAChC,GAAG,EAAE,yBAAyB,MAAM,EAAE;gBACtC,GAAG,EAAE,SAAS;aACf,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YAC/B,OAAO,CACL,2DAA2D;gBAC3D,qCAAqC;gBACrC,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,wBAAwB,EAAE,CAAC;YACrC,OAAO,CACL,2DAA2D;gBAC3D,qCAAqC;gBACrC,oDAAoD;gBACpD,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YAC9B,OAAO,CACL,iEAAiE;gBACjE,kEAAkE;gBAClE,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,CACL,sEAAsE;YACtE,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,CACL,2BAA2B;gBAC3B,mEAAmE;gBACnE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,CACL,uEAAuE;YACvE,8CAA8C,CAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/analysis/taint-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAElK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAwF7E,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CAWP;AA0JD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AAi5FD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}
+{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAElK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAwF7E,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CAWP;AA0JD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AAw8FD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}

package/dist/analysis/taint-matcher.js

@@ -1793,6 +1793,53 @@ function classifyGoDestinationType(decl) {
     // include the untyped tokens above, treat it as safe.
     return 'safe';
 }
+/**
+ * #456 — true when a Go `fmt.Fprint` / `Fprintf` / `Fprintln` xss sink's
+ * writer (arg[0]) does NOT resolve to an `http.ResponseWriter` parameter of
+ * the enclosing function. Only the plain identifier form is recognised (`w`,
+ * `rw`, `resp`); the signature may wrap, so up to four lines from the nearest
+ * preceding `func` are joined before matching. Anything else — a field, a
+ * call result, a shadowed name — is treated as not a response writer.
+ */
+function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
+    if (language !== 'go')
+        return false;
+    if (pattern.type !== 'xss' || pattern.class !== 'fmt')
+        return false;
+    if (!/^Fprint(?:f|ln)?$/.test(call.method_name))
+        return false;
+    if (!sourceLines)
+        return true;
+    const writer = call.arguments.find(a => a.position === 0);
+    const name = (writer?.expression ?? '').trim();
+    if (!/^[A-Za-z_]\w*$/.test(name))
+        return true;
+    // Walk up to the nearest enclosing `func` header — a top-level declaration OR
+    // an inline closure (`router.GET("/", func(w http.ResponseWriter, …) {`), which
+    // is the common handler shape and does not start the line. The first `func`
+    // above the call whose parameter list names the writer as an http.ResponseWriter
+    // keeps the sink; the first one that does not drops it.
+    const rwRe = new RegExp(`\\b${name}\\s+(?:net/)?http\\.ResponseWriter\\b`);
+    for (let i = call.location.line - 1; i >= 0; i--) {
+        const line = sourceLines[i] ?? '';
+        const funcIdx = line.search(/\bfunc\b/);
+        if (funcIdx < 0)
+            continue;
+        // Parameter list is between this `func` and the opening brace of its body,
+        // which may be a few lines down when the signature wraps.
+        const header = sourceLines.slice(i, i + 4).join(' ');
+        const brace = header.indexOf('{');
+        const params = header.slice(funcIdx, brace >= 0 ? brace : header.length);
+        if (rwRe.test(params))
+            return false; // writer is this scope's ResponseWriter
+        // A named function that does not take the writer: the name is not a
+        // response writer here. An inline closure that does not either — keep
+        // climbing, an outer scope may still bind it.
+        if (/^\s*func\b/.test(line))
+            return true;
+    }
+    return true;
+}
 /**
  * Gate for Go `json.Unmarshal(data, &dst)` / `json.NewDecoder(r).Decode(&dst)`
  * deserialization (CWE-502) sinks. Returns `true` when the destination is a
@@ -2131,6 +2178,15 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
                 if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
                     continue;
                 }
+                // #456 — Go fmt.Fprint*(writer, …) is xss only when the writer is the
+                // enclosing handler's http.ResponseWriter. Any other writer (stderr,
+                // a file, a buffer) keeps the CWE-134 format_string sink and nothing
+                // else. Unresolvable writers are dropped: an xss finding that names
+                // the wrong sphere is worse than the low-confidence escape it
+                // replaces.
+                if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
+                    continue;
+                }
                 // #147 — Jinja2 safe render-context. Template("literal").render(**ctx)
                 // and render_template_string("literal", **ctx) and Template("literal")
                 // alone are safe: the template SOURCE is a constant string and Jinja2