circle-ir 4.9.21 → 4.9.23

package/dist/browser/circle-ir.js

@@ -16257,6 +16257,27 @@ function classifyGoDestinationType(decl) {
   if (/\bany\b/.test(text)) return "unsafe";
   return "safe";
 }
+function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
+  if (language !== "go") return false;
+  if (pattern.type !== "xss" || pattern.class !== "fmt") return false;
+  if (!/^Fprint(?:f|ln)?$/.test(call.method_name)) return false;
+  if (!sourceLines) return true;
+  const writer = call.arguments.find((a) => a.position === 0);
+  const name2 = (writer?.expression ?? "").trim();
+  if (!/^[A-Za-z_]\w*$/.test(name2)) return true;
+  const rwRe = new RegExp(`\\b${name2}\\s+(?:net/)?http\\.ResponseWriter\\b`);
+  for (let i2 = call.location.line - 1; i2 >= 0; i2--) {
+    const line = sourceLines[i2] ?? "";
+    const funcIdx = line.search(/\bfunc\b/);
+    if (funcIdx < 0) continue;
+    const header = sourceLines.slice(i2, i2 + 4).join(" ");
+    const brace = header.indexOf("{");
+    const params = header.slice(funcIdx, brace >= 0 ? brace : header.length);
+    if (rwRe.test(params)) return false;
+    if (/^\s*func\b/.test(line)) return true;
+  }
+  return true;
+}
 function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   if (language !== "go") return false;
   if (pattern.type !== "deserialization") return false;
@@ -16389,6 +16410,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -19216,6 +19240,114 @@ function buildTaintFlow(source, sink, taintInfo) {
 }
 
 // src/analysis/interprocedural.ts
+var GO_BUILTIN_CALLS = /* @__PURE__ */ new Set([
+  "len",
+  "cap",
+  "make",
+  "new",
+  "append",
+  "copy",
+  "delete",
+  "close",
+  "panic",
+  "recover",
+  "print",
+  "println",
+  "min",
+  "max",
+  "clear",
+  "string",
+  "int",
+  "int8",
+  "int16",
+  "int32",
+  "int64",
+  "uint",
+  "uint8",
+  "uint16",
+  "uint32",
+  "uint64",
+  "float32",
+  "float64",
+  "bool",
+  "byte",
+  "rune",
+  "error"
+]);
+var GO_ERROR_AND_LOG_CALLS = /* @__PURE__ */ new Set([
+  "Errorf",
+  // string formatting that returns a string
+  "Sprintf",
+  "Sprint",
+  "Sprintln",
+  // logging verbs (stdlib log, klog/glog, logrus, zap, zerolog)
+  "Print",
+  "Printf",
+  "Println",
+  "Fatal",
+  "Fatalf",
+  "Fatalln",
+  "Panic",
+  "Panicf",
+  "Panicln",
+  "Debug",
+  "Debugf",
+  "Debugln",
+  "Debugw",
+  "Info",
+  "Infof",
+  "Infoln",
+  "Infow",
+  "InfoS",
+  "Warn",
+  "Warnf",
+  "Warnln",
+  "Warnw",
+  "Warning",
+  "Warningf",
+  "Warningln",
+  "Error",
+  "Errorln",
+  "Errorw",
+  "ErrorS",
+  "Trace",
+  "Tracef",
+  "V",
+  "WithError",
+  "WithField",
+  "WithFields",
+  "WithValues",
+  "Msg",
+  "Msgf"
+]);
+var GO_ERROR_PACKAGES = /* @__PURE__ */ new Set(["errors", "status", "xerrors", "multierr", "multierror"]);
+var GO_PURE_PACKAGES = /* @__PURE__ */ new Set([
+  "strings",
+  "strconv",
+  "bytes",
+  "unicode",
+  "utf8",
+  "path",
+  "filepath",
+  "math",
+  "sort",
+  "slices",
+  "maps",
+  "time",
+  "regexp",
+  "url",
+  "hex",
+  "base64"
+]);
+function isGoNonEscapeCall(call) {
+  const name2 = call.method_name;
+  const recv = (call.receiver ?? "").split(".").pop() ?? "";
+  if (!call.receiver && GO_BUILTIN_CALLS.has(name2)) return true;
+  if (GO_ERROR_PACKAGES.has(recv)) return true;
+  if (GO_PURE_PACKAGES.has(recv)) return true;
+  if (GO_ERROR_AND_LOG_CALLS.has(name2)) return true;
+  return false;
+}
 function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
   let graph;
   let sources;
@@ -19470,6 +19602,9 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
     if (!targetMethod) {
       if (taintedArgPositions.length > 0 && !collectionMethods.has(call.method_name) && !sanitizerMethods.has(call.method_name) && !safeUtilityMethods.has(call.method_name) && !ormQueryBuilderMethods.has(call.method_name)) {
         const isBash = graph.ir.meta.language === "bash";
+        if (graph.ir.meta.language === "go" && isGoNonEscapeCall(call)) {
+          continue;
+        }
         const bashSafeBuiltins = /* @__PURE__ */ new Set([
           "echo",
           "printf",
@@ -25924,14 +26059,33 @@ var GoPlugin = class extends BaseLanguagePlugin {
       // rather than content — a weaker finding that would fire on every
       // path-validation helper that stats before opening, including the
       // correct ones. Left out until there is corpus evidence it pays.
-      // XSS (writing to http.ResponseWriter without escaping)
+      // XSS (writing to http.ResponseWriter without escaping). The format
+      // string AND the varargs — `Fprintf(w, "%s", q)` is the common shape
+      // (#456). Gated in taint-matcher on arg[0] resolving to an
+      // http.ResponseWriter parameter, so `Fprintf(os.Stderr, …)` is not xss.
       {
         method: "Fprintf",
         class: "fmt",
         type: "xss",
         cwe: "CWE-79",
         severity: "high",
-        argPositions: [1]
+        argPositions: [1, 2, 3, 4, 5, 6]
+      },
+      {
+        method: "Fprint",
+        class: "fmt",
+        type: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        argPositions: [1, 2, 3, 4, 5, 6]
+      },
+      {
+        method: "Fprintln",
+        class: "fmt",
+        type: "xss",
+        cwe: "CWE-79",
+        severity: "high",
+        argPositions: [1, 2, 3, 4, 5, 6]
       },
       {
         method: "Write",
@@ -26446,16 +26600,21 @@ var CSharpPlugin = class extends BaseLanguagePlugin {
 };
 
 // src/languages/plugins/index.ts
+function createBuiltinPlugins() {
+  return [
+    new JavaPlugin(),
+    new JavaScriptPlugin(),
+    new PythonPlugin(),
+    new RustPlugin(),
+    new BashPlugin(),
+    new HtmlPlugin(),
+    new VuePlugin(),
+    new GoPlugin(),
+    new CSharpPlugin()
+  ];
+}
 function registerBuiltinPlugins() {
-  registerLanguage(new JavaPlugin());
-  registerLanguage(new JavaScriptPlugin());
-  registerLanguage(new PythonPlugin());
-  registerLanguage(new RustPlugin());
-  registerLanguage(new BashPlugin());
-  registerLanguage(new HtmlPlugin());
-  registerLanguage(new VuePlugin());
-  registerLanguage(new GoPlugin());
-  registerLanguage(new CSharpPlugin());
+  for (const plugin of createBuiltinPlugins()) registerLanguage(plugin);
 }
 
 // src/analysis/html/html-extractor.ts
@@ -27330,6 +27489,8 @@ var LanguageSourcesPass = class {
     additionalSources.push(...findGoArgvSources(code, language));
     additionalSources.push(...findGoArchiveEntrySources(code, language));
     additionalSources.push(...findGoMultipartUploadSources(code, language));
+    additionalSources.push(...findGoGrpcRequestSources(code, language));
+    additionalSources.push(...findGoRequestBodySources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -28107,6 +28268,121 @@ function findGoMultipartUploadSources(sourceCode, language) {
   }
   return sources;
 }
+function findGoGrpcRequestSources(sourceCode, language) {
+  if (language !== "go") return [];
+  if (!sourceCode.includes("context.Context")) return [];
+  const sources = [];
+  const lines = sourceCode.split("\n");
+  const sigRe = /^func\s*\([^)]*\)\s*[A-Z]\w*\s*\(\s*\w+\s+context\.Context\s*,\s*([A-Za-z_]\w*)\s+\*(?:\w+\.)?\w*(?:Request|Req)\s*\)\s*\(\s*\*[\w.]+\s*,\s*error\s*\)\s*\{/;
+  const controlRe = /^\s*(?:\}\s*else\s+)?(?:if|for|switch|case|return)\b/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const sig = sigRe.exec(lines[i2]);
+    if (!sig) continue;
+    const param = sig[1];
+    if (param === "_") continue;
+    const readRe = new RegExp(
+      `(?<![\\w.])${param}\\s*\\.\\s*(?:Get[A-Z]\\w*\\s*\\(\\s*\\)|[A-Z]\\w*\\b(?!\\s*\\())`
+    );
+    const directReadRe = new RegExp(
+      `^(?:(?:\\[\\]\\w+|string)\\s*\\(\\s*)*${param}(?:\\s*\\.\\s*(?:Get[A-Z]\\w*\\s*\\(\\s*\\)|[A-Z]\\w*\\b(?!\\s*\\()))+(?:\\s*\\))*$`
+    );
+    const numericParseRe = new RegExp(
+      `\\bstrconv\\s*\\.\\s*(?:Atoi|ParseInt|ParseUint|ParseFloat|ParseBool)\\s*\\(\\s*${param}\\s*\\.`
+    );
+    let end = i2 + 1;
+    while (end < lines.length && !/^\}/.test(lines[end])) end++;
+    for (let j = i2 + 1; j < end; j++) {
+      const line = lines[j];
+      const read = readRe.exec(line);
+      if (!read) continue;
+      if (numericParseRe.test(line)) continue;
+      let variable;
+      const unmarshal = /\bUnmarshal\w*\s*\([^&]*&\s*([A-Za-z_]\w*)/.exec(line);
+      const assign = /^\s*(?:var\s+)?([A-Za-z_][\w\s,]*?)\s*:?=(?!=)\s*(.+)$/.exec(line);
+      if (unmarshal && line.indexOf(read[0]) < line.indexOf("&")) {
+        variable = unmarshal[1];
+      } else if (assign && directReadRe.test(assign[2].trim()) && !controlRe.test(line)) {
+        variable = assign[1].split(",").map((v) => v.trim()).find((v) => v !== "_" && v !== "err" && v !== "ok" && /^[A-Za-z_]\w*$/.test(v));
+        if (!variable) continue;
+      } else if (controlRe.test(line)) {
+        continue;
+      } else {
+        variable = param;
+      }
+      const lineNumber = j + 1;
+      if (sources.some((sc) => sc.line === lineNumber && sc.variable === variable)) continue;
+      sources.push({
+        type: "http_body",
+        location: `${read[0].replace(/\s+/g, "")} \u2014 field of the gRPC request message \`${param}\``,
+        severity: "high",
+        line: lineNumber,
+        confidence: 0.85,
+        variable
+      });
+    }
+    i2 = end;
+  }
+  return sources;
+}
+function findGoRequestBodySources(sourceCode, language) {
+  if (language !== "go") return [];
+  if (!sourceCode.includes(".Body")) return [];
+  const lines = sourceCode.split("\n");
+  const reqNames = /* @__PURE__ */ new Set();
+  const paramRe = /([A-Za-z_]\w*)\s+\*http\.Request\b/g;
+  for (const line of lines) {
+    let m;
+    paramRe.lastIndex = 0;
+    while ((m = paramRe.exec(line)) !== null) reqNames.add(m[1]);
+  }
+  if (reqNames.size === 0) return [];
+  const bodyAlt = [...reqNames].map((n) => n.replace(/\$/g, "\\$")).join("|");
+  const bodyRef = `(?<![\\w.])(?:${bodyAlt})\\s*\\.\\s*Body\\b`;
+  const sources = [];
+  const push = (variable, line, how) => {
+    if (variable === "_" || variable === "") return;
+    if (sources.some((s) => s.line === line && s.variable === variable)) return;
+    sources.push({
+      type: "http_body",
+      location: `${how} \u2014 HTTP request body`,
+      severity: "high",
+      line,
+      confidence: 0.85,
+      ...variable ? { variable } : {}
+    });
+  };
+  const bodyRe = new RegExp(bodyRef);
+  const decodeRe = new RegExp(
+    `(?:json|xml)\\s*\\.\\s*NewDecoder\\s*\\(\\s*(?:io\\.NopCloser\\s*\\(\\s*)?(?:${bodyAlt})\\s*\\.\\s*Body\\b[^)]*\\)\\s*\\)?\\s*\\.\\s*Decode\\s*\\(\\s*&\\s*([A-Za-z_]\\w*)`
+  );
+  const readAllRe = new RegExp(
+    `\\b([A-Za-z_]\\w*)\\s*,\\s*\\w+\\s*:?=\\s*(?:io|ioutil)\\s*\\.\\s*ReadAll\\s*\\(\\s*(?:${bodyAlt})\\s*\\.\\s*Body\\b`
+  );
+  const copyRe = new RegExp(
+    `\\bio\\s*\\.\\s*Copy\\s*\\(\\s*([A-Za-z_]\\w*|&\\s*[A-Za-z_]\\w*)\\s*,\\s*(?:${bodyAlt})\\s*\\.\\s*Body\\b`
+  );
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (!bodyRe.test(line)) continue;
+    const n = i2 + 1;
+    const dec = decodeRe.exec(line);
+    if (dec) {
+      push(dec[1], n, `json/xml decode of ${dec[0].split(".")[0]}.Body`);
+      continue;
+    }
+    const ra = readAllRe.exec(line);
+    if (ra) {
+      push(ra[1], n, "io.ReadAll(req.Body)");
+      continue;
+    }
+    const cp = copyRe.exec(line);
+    if (cp) {
+      push(cp[1].replace(/^&\s*/, ""), n, "io.Copy(dst, req.Body)");
+      continue;
+    }
+  }
+  return sources;
+}
 function findCSharpRequestSources(sourceCode, language) {
   if (language !== "csharp") return [];
   const sources = [];
@@ -46241,6 +46517,8 @@ var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
 var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
 var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
 var JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
+var JAVA_HARDENING_SETTER_RE = /\.\s*(?:setFeature|setAttribute|setProperty|setXIncludeAware|setExpandEntityReferences)\s*\(/;
+var JAVA_FACTORY_CHAINED_RE = /\bnewInstance\s*\([^()]*\)\s*\.\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\s*\(/;
 var PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 var XmlEntityExpansionPass = class {
   name = "xml-entity-expansion";
@@ -46252,7 +46530,9 @@ var XmlEntityExpansionPass = class {
     const code = ctx.code ?? "";
     if (language === "java") {
       const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
-      if (safeInFile) return { findings };
+      const processWide = safeInFile && /jdk\.xml\./.test(code);
+      const lines = safeInFile ? code.split("\n") : [];
+      const methodRanges = safeInFile ? this.methodRanges(graph.ir.types) : [];
       const isXmlOutputOnly = JAVA_XML_OUTPUT_ONLY_RE.test(code) && !JAVA_XML_PARSE_INPUT_RE.test(code);
       const isDocumentBuilderEmptyOnly = JAVA_DOC_BUILDER_NEW_DOCUMENT_RE.test(code) && !JAVA_DOC_BUILDER_PARSE_RE.test(code);
       for (const call of graph.ir.calls) {
@@ -46262,6 +46542,8 @@ var XmlEntityExpansionPass = class {
         if (det.api === "DocumentBuilderFactory" && isDocumentBuilderEmptyOnly)
           continue;
         const line = call.location.line;
+        if (safeInFile && (processWide || !this.isProvablyUnhardened(lines, line, methodRanges, det.api)))
+          continue;
         findings.push({ line, language, ...det });
         ctx.addFinding({
           id: `${this.name}-${file}-${line}-${det.api}`,
@@ -46271,11 +46553,11 @@ var XmlEntityExpansionPass = class {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} created without disabling DTD / external-entity processing. Vulnerable to billion-laughs / quadratic blow-up DoS (CWE-776) and external-entity disclosure (CWE-611). Add \`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)\` (or the equivalent) before parsing.`,
+          message: `${det.api} created without disabling DTD / external-entity processing. Vulnerable to external-entity disclosure (CWE-611) and billion-laughs / quadratic blow-up DoS (CWE-776). Add \`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)\` (or the equivalent) before parsing.`,
           file,
           line,
           fix: this.fixForJava(det.api),
-          evidence: { ...det, language, safeFeatureInFile: false }
+          evidence: { ...det, language, safeFeatureInFile: safeInFile }
         });
       }
       return { findings };
@@ -46296,7 +46578,7 @@ var XmlEntityExpansionPass = class {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} called without an entity-safe parser. Vulnerable to billion-laughs / quadratic blow-up DoS (CWE-776) and external-entity disclosure (CWE-611). Use \`defusedxml\` or pass an \`XMLParser(resolve_entities=False)\` to lxml.`,
+          message: `${det.api} called without an entity-safe parser. Vulnerable ` + (det.cwe === "CWE-611" ? "to external-entity disclosure (CWE-611) and billion-laughs / quadratic blow-up DoS (CWE-776). " : "to billion-laughs / quadratic blow-up DoS (CWE-776). ") + "Use `defusedxml` or pass an `XMLParser(resolve_entities=False)` to lxml.",
           file,
           line,
           fix: this.fixForPython(det.api),
@@ -46307,6 +46589,78 @@ var XmlEntityExpansionPass = class {
     }
     return { findings };
   }
+  methodRanges(types) {
+    const out2 = [];
+    for (const t of types ?? []) {
+      for (const m of t.methods ?? []) {
+        if (typeof m.start_line === "number" && typeof m.end_line === "number")
+          out2.push([m.start_line, m.end_line]);
+      }
+    }
+    return out2;
+  }
+  /**
+   * In a file that DOES contain hardening evidence, is the factory created on
+   * `line` one that provably never receives it?
+   *
+   * Deliberately one-sided. It answers true for exactly two shapes:
+   *
+   *   1. CHAINED — `Factory.newInstance().newDocumentBuilder()`, where the
+   *      product is not handed on or returned either.
+   *   2. LOCAL — `Factory f = Factory.newInstance();` where the enclosing method
+   *      builds a parser from `f`, never hands `f` to another call, and never
+   *      returns it.
+   *
+   * and in both only when the enclosing method contains NO hardening-capable
+   * setter on ANY receiver, since hardening may land on the factory's product
+   * (`parser.getXMLReader().setFeature(…)`) rather than the factory.
+   *
+   * Every other shape — a field, a helper that takes the factory, a caller that
+   * receives it — may be hardened somewhere this check cannot see, so it keeps
+   * the previous file-level silence.
+   *
+   * A TransformerFactory additionally needs a `StreamSource` in its method: that
+   * is the input the transformer parses with its OWN parser. Fed a `DOMSource`
+   * it parses nothing, and fed a `SAXSource` it uses the reader it was given —
+   * whose hardening is that reader's business, not this factory's.
+   */
+  isProvablyUnhardened(lines, line, methodRanges, api) {
+    let range = null;
+    for (const r of methodRanges) {
+      if (line < r[0] || line > r[1]) continue;
+      if (!range || r[1] - r[0] < range[1] - range[0]) range = r;
+    }
+    if (!range) return false;
+    let decl = "";
+    let declEnd = line;
+    for (; declEnd <= Math.min(line + 3, range[1]); declEnd++) {
+      decl += " " + (lines[declEnd - 1] ?? "").trim();
+      if (decl.includes(";")) break;
+    }
+    const body2 = lines.slice(line - 1, range[1]).join("\n");
+    if (api === "TransformerFactory" && !/\bnew\s+StreamSource\s*\(/.test(body2))
+      return false;
+    if (JAVA_HARDENING_SETTER_RE.test(body2)) return false;
+    const chained = JAVA_FACTORY_CHAINED_RE.exec(decl);
+    if (chained) {
+      const prod = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=/.exec(decl);
+      if (!prod) return true;
+      const pn = prod[1].replace(/\$/g, "\\$");
+      const after = lines.slice(declEnd, range[1]).join("\n");
+      return !new RegExp(`[(,]\\s*${pn}\\s*[,)]|\\breturn\\s+${pn}\\s*;`).test(after);
+    }
+    const m = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.]*\bnewInstance\s*\([^()]*\)\s*;/.exec(decl);
+    if (!m) return false;
+    const name2 = m[1].replace(/\$/g, "\\$");
+    const rest = lines.slice(declEnd, range[1]).join("\n");
+    const builds = new RegExp(
+      `\\b${name2}\\s*\\.\\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\\s*\\(`
+    );
+    if (!builds.test(rest)) return false;
+    const escapes = new RegExp(`[(,]\\s*${name2}\\s*[,)]|\\breturn\\s+${name2}\\s*;`);
+    if (escapes.test(rest)) return false;
+    return true;
+  }
   detectJavaCall(call) {
     if (call.method_name !== "newInstance") return null;
     const recv = call.receiver ?? "";
@@ -46316,7 +46670,7 @@ var XmlEntityExpansionPass = class {
         return {
           pattern: `${factory}.newInstance()`,
           api: factory,
-          cwe: "CWE-776"
+          cwe: "CWE-611"
         };
       }
     }
@@ -46329,7 +46683,7 @@ var XmlEntityExpansionPass = class {
       return {
         pattern: `etree.${method}`,
         api: `lxml.etree.${method}`,
-        cwe: "CWE-776"
+        cwe: "CWE-611"
       };
     }
     if ((method === "parse" || method === "fromstring") && (recv === "ET" || recv === "ElementTree" || recv.endsWith(".ElementTree"))) {

package/dist/core/circle-ir-core.cjs

@@ -15557,6 +15557,27 @@ function classifyGoDestinationType(decl) {
   if (/\bany\b/.test(text)) return "unsafe";
   return "safe";
 }
+function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
+  if (language !== "go") return false;
+  if (pattern.type !== "xss" || pattern.class !== "fmt") return false;
+  if (!/^Fprint(?:f|ln)?$/.test(call.method_name)) return false;
+  if (!sourceLines) return true;
+  const writer = call.arguments.find((a) => a.position === 0);
+  const name2 = (writer?.expression ?? "").trim();
+  if (!/^[A-Za-z_]\w*$/.test(name2)) return true;
+  const rwRe = new RegExp(`\\b${name2}\\s+(?:net/)?http\\.ResponseWriter\\b`);
+  for (let i2 = call.location.line - 1; i2 >= 0; i2--) {
+    const line = sourceLines[i2] ?? "";
+    const funcIdx = line.search(/\bfunc\b/);
+    if (funcIdx < 0) continue;
+    const header = sourceLines.slice(i2, i2 + 4).join(" ");
+    const brace = header.indexOf("{");
+    const params = header.slice(funcIdx, brace >= 0 ? brace : header.length);
+    if (rwRe.test(params)) return false;
+    if (/^\s*func\b/.test(line)) return true;
+  }
+  return true;
+}
 function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   if (language !== "go") return false;
   if (pattern.type !== "deserialization") return false;
@@ -15689,6 +15710,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }

package/dist/core/circle-ir-core.js

@@ -15491,6 +15491,27 @@ function classifyGoDestinationType(decl) {
   if (/\bany\b/.test(text)) return "unsafe";
   return "safe";
 }
+function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
+  if (language !== "go") return false;
+  if (pattern.type !== "xss" || pattern.class !== "fmt") return false;
+  if (!/^Fprint(?:f|ln)?$/.test(call.method_name)) return false;
+  if (!sourceLines) return true;
+  const writer = call.arguments.find((a) => a.position === 0);
+  const name2 = (writer?.expression ?? "").trim();
+  if (!/^[A-Za-z_]\w*$/.test(name2)) return true;
+  const rwRe = new RegExp(`\\b${name2}\\s+(?:net/)?http\\.ResponseWriter\\b`);
+  for (let i2 = call.location.line - 1; i2 >= 0; i2--) {
+    const line = sourceLines[i2] ?? "";
+    const funcIdx = line.search(/\bfunc\b/);
+    if (funcIdx < 0) continue;
+    const header = sourceLines.slice(i2, i2 + 4).join(" ");
+    const brace = header.indexOf("{");
+    const params = header.slice(funcIdx, brace >= 0 ? brace : header.length);
+    if (rwRe.test(params)) return false;
+    if (/^\s*func\b/.test(line)) return true;
+  }
+  return true;
+}
 function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   if (language !== "go") return false;
   if (pattern.type !== "deserialization") return false;
@@ -15623,6 +15644,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }

package/dist/index.d.ts

@@ -12,6 +12,7 @@ export type { UnboundedCollectionOptions } from './analysis/passes/unbounded-col
 export type { PassOptions } from './analyzer.js';
 export type { CircleIR, Meta, TypeInfo, MethodInfo, ParameterInfo, FieldInfo, CallInfo, ArgumentInfo, CallResolution, CFG, CFGBlock, CFGEdge, DFG, DFGDef, DFGUse, DFGChain, Taint, TaintSource, TaintSink, TaintSanitizer, ImportInfo, ExportInfo, UnresolvedItem, Enriched, EnrichedFunction, ResolvedCall, Finding, TaintHop, Vulnerability, AnalysisResponse, SourceType, SinkType, Severity, ProjectShape, ProjectEnv, ProjectProfile, ProjectProfileSummary, PassCategory, SarifLevel, SastFinding, MetricCategory, MetricValue, FileMetrics, ProjectAnalysis, ProjectMeta, FileAnalysis, TypeHierarchy, ClassHierarchyInfo, InterfaceHierarchyInfo, CrossFileCall, ArgMapping, TaintPath, } from './types/index.js';
 export { SOURCE_TYPES, SINK_TYPES } from './types/index.js';
+export { getModelledCwes, isModelledCwe, RELATED_CWE, type ModelledCwes, } from './analysis/modelled-cwes.js';
 export type { SourceConfig, SinkConfig, TaintConfig, SourcePattern, SinkPattern, SanitizerPattern, } from './types/config.js';
 export { initParser, parse, walkTree, findNodes, findAncestor, getNodeText, collectAllNodes, type SupportedLanguage, type SyntaxNode, type Node, type NodeCache, type Tree, } from './core/index.js';
 export { extractMeta, extractTypes, extractCalls, extractImports, extractExports, buildCFG, buildDFG, } from './core/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,UAAU,EACV,SAAS,EACT,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,YAAY,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,YAAY,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,YAAY,EAEV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,GAAG,EACH,QAAQ,EACR,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,KAAK,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,UAAU,EACV,UAAU,EACV,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,gBAAgB,EAGhB,UAAU,EACV,QAAQ,EACR,QAAQ,EAGR,YAAY,EACZ,UAAU,EACV,cAAc,EACd,qBAAqB,EAGrB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,EACd,WAAW,EACX,WAAW,EAGX,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG5D,YAAY,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,IAAI,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAGxF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,UAAU,EACV,SAAS,EACT,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AAC3F,YAAY,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC5F,YAAY,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACjG,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,YAAY,EAEV,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,aAAa,EACb,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,GAAG,EACH,QAAQ,EACR,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,KAAK,EACL,WAAW,EACX,SAAS,EACT,cAAc,EACd,UAAU,EACV,UAAU,EACV,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,aAAa,EACb,gBAAgB,EAGhB,UAAU,EACV,QAAQ,EACR,QAAQ,EAGR,YAAY,EACZ,UAAU,EACV,cAAc,EACd,qBAAqB,EAGrB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,EACd,WAAW,EACX,WAAW,EAGX,eAAe,EACf,WAAW,EACX,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI5D,OAAO,EACL,eAAe,EACf,aAAa,EACb,WAAW,EACX,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAC;AAGrC,YAAY,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,IAAI,GACV,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAGxF,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -16,6 +16,9 @@ export { parseNpmDependencies, parseNpmLockDependencies, parsePypiDependencies,
 // an unmatched value fails a test on their side rather than falling through
 // to a default branch. Locked by tests/public-entry-exports.test.ts.
 export { SOURCE_TYPES, SINK_TYPES } from './types/index.js';
+// Modelled-CWE export (#393) — which weakness classes the taint engine covers,
+// derived from the live sink registries.
+export { getModelledCwes, isModelledCwe, RELATED_CWE, } from './analysis/modelled-cwes.js';
 // Core utilities (for advanced usage)
 export { initParser, parse, walkTree, findNodes, findAncestor, getNodeText, collectAllNodes, } from './core/index.js';
 // Core extractors

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GAEd,MAAM,eAAe,CAAC;AAEvB,4EAA4E;AAC5E,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AA+E5B,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAY5D,sCAAsC;AACtC,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,GAMnB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iCAAiC,CAAC;AAExF,uBAAuB;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAY9B,gCAAgC;AAChC,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GAEd,MAAM,eAAe,CAAC;AAEvB,4EAA4E;AAC5E,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,MAAM,GACP,MAAM,oBAAoB,CAAC;AA+E5B,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,qEAAqE;AACrE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE5D,+EAA+E;AAC/E,yCAAyC;AACzC,OAAO,EACL,eAAe,EACf,aAAa,EACb,WAAW,GAEZ,MAAM,6BAA6B,CAAC;AAYrC,sCAAsC;AACtC,OAAO,EACL,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,WAAW,EACX,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AAEzB,kBAAkB;AAClB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,QAAQ,EACR,QAAQ,GACT,MAAM,iBAAiB,CAAC;AAEzB,qBAAqB;AACrB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,gCAAgC,EAChC,0BAA0B,EAC1B,kBAAkB,EAClB,OAAO,EACP,aAAa,EACb,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,GAMnB,MAAM,qBAAqB,CAAC;AAE7B,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAqB,MAAM,iCAAiC,CAAC;AAExF,uBAAuB;AACvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAY9B,gCAAgC;AAChC,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,mBAAmB,CAAC"}

package/dist/languages/plugins/go.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/go.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,qBAAa,QAAS,SAAQ,kBAAkB;IAC9C,QAAQ,CAAC,EAAE,EAAG,IAAI,CAAU;IAC5B,QAAQ,CAAC,IAAI,QAAQ;IACrB,QAAQ,CAAC,UAAU,WAAW;IAC9B,QAAQ,CAAC,QAAQ,yBAAyB;IAE1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CA+BnC;IAEF;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS,CAsDrE;IAED;;OAEG;IACH,iBAAiB,IAAI,kBAAkB,EAAE,CAiGxC;IAED;;;;;;OAMG;IACH,eAAe,IAAI,gBAAgB,EAAE,CAkXpC;IAED;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAejF;IAED;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAGzC;IAED;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnD;IAED;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE,CAwFnD;IAED;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE,CAoDnD;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,EAAE,CA2BvD;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAc7D;IAID,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,eAAe;CAiBxB"}
+{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/go.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,qBAAa,QAAS,SAAQ,kBAAkB;IAC9C,QAAQ,CAAC,EAAE,EAAG,IAAI,CAAU;IAC5B,QAAQ,CAAC,IAAI,QAAQ;IACrB,QAAQ,CAAC,UAAU,WAAW;IAC9B,QAAQ,CAAC,QAAQ,yBAAyB;IAE1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CA+BnC;IAEF;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS,CAsDrE;IAED;;OAEG;IACH,iBAAiB,IAAI,kBAAkB,EAAE,CAiGxC;IAED;;;;;;OAMG;IACH,eAAe,IAAI,gBAAgB,EAAE,CAqYpC;IAED;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAejF;IAED;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAGzC;IAED;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnD;IAED;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE,CAwFnD;IAED;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE,CAoDnD;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,EAAE,CA2BvD;IAED;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAc7D;IAID,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,eAAe;CAiBxB"}