codesift-mcp 0.14.0 → 0.15.0

package/dist/tools/taint-tools.js

@@ -1,857 +1,7 @@
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
 import { getParser } from "../parser/parser-manager.js";
-import { detectSrcLayout, resolvePythonImport } from "../utils/python-import-resolver.js";
 import { getCodeIndex } from "./index-tools.js";
-const DEFAULT_MAX_DEPTH = 4;
-const DEFAULT_MAX_TRACES = 50;
-const DEFAULT_SOURCE_PATTERNS = [
-    "request.GET",
-    "request.POST",
-    "request.body",
-    "request.data",
-    "request.headers",
-    "request.COOKIES",
-    "request.META",
-];
-const DEFAULT_SINK_PATTERNS = [
-    "redirect",
-    "mark_safe",
-    "cursor.execute",
-    "subprocess",
-    "requests",
-    "httpx",
-    "open",
-    "session-write",
-];
-const KNOWN_SANITIZERS = new Set([
-    "escape",
-    "conditional_escape",
-    "urlquote",
-    "quote",
-    "quote_plus",
-]);
-function clonePath(path) {
-    return {
-        source: { ...path.source },
-        hops: path.hops.map((hop) => ({ ...hop })),
-        heuristic: path.heuristic,
-    };
-}
-function pathKey(path) {
-    return JSON.stringify({
-        source: path.source,
-        hops: path.hops,
-        heuristic: path.heuristic,
-    });
-}
-function dedupePaths(paths) {
-    const seen = new Set();
-    const result = [];
-    for (const path of paths) {
-        const key = pathKey(path);
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        result.push(path);
-    }
-    return result;
-}
-function cloneEnv(env) {
-    const next = new Map();
-    for (const [name, paths] of env.entries()) {
-        next.set(name, paths.map(clonePath));
-    }
-    return next;
-}
-function mergeEnvs(...envs) {
-    const merged = new Map();
-    for (const env of envs) {
-        for (const [name, paths] of env.entries()) {
-            const existing = merged.get(name) ?? [];
-            merged.set(name, dedupePaths([...existing, ...paths.map(clonePath)]));
-        }
-    }
-    return merged;
-}
-function appendHop(paths, hop, options) {
-    return dedupePaths(paths.map((path) => ({
-        source: { ...path.source },
-        hops: [...path.hops.map((entry) => ({ ...entry })), { ...hop }],
-        heuristic: path.heuristic || Boolean(options?.heuristic),
-    })));
-}
-function computeConfidence(path) {
-    if (path.heuristic)
-        return "medium";
-    if (path.hops.length >= 4)
-        return "medium";
-    return "high";
-}
-function lineForNode(symbol, node) {
-    return symbol.start_line + node.startPosition.row;
-}
-function codeForNode(node) {
-    return node.text.split("\n")[0]?.trim() ?? node.text.trim();
-}
-function getAttributePath(node) {
-    if (!node)
-        return null;
-    if (node.type === "identifier")
-        return node.text;
-    if (node.type === "attribute") {
-        const objectNode = node.childForFieldName("object") ?? node.namedChild(0);
-        const attributeNode = node.childForFieldName("attribute") ?? node.namedChild(1);
-        const objectPath = getAttributePath(objectNode);
-        const attributePath = getAttributePath(attributeNode);
-        if (!objectPath || !attributePath)
-            return null;
-        return `${objectPath}.${attributePath}`;
-    }
-    return null;
-}
-function getCallArguments(argsNode) {
-    if (!argsNode)
-        return [];
-    const args = [];
-    let index = 0;
-    for (const child of argsNode.namedChildren) {
-        if (child.type === "keyword_argument") {
-            const keywordNode = child.namedChildren[0];
-            const valueNode = child.namedChildren[1];
-            if (!valueNode)
-                continue;
-            const arg = {
-                node: valueNode,
-                index,
-            };
-            if (keywordNode?.text)
-                arg.keyword = keywordNode.text;
-            args.push(arg);
-            index += 1;
-            continue;
-        }
-        args.push({
-            node: child,
-            index,
-        });
-        index += 1;
-    }
-    return args;
-}
-function getParameterName(node) {
-    switch (node.type) {
-        case "identifier":
-            return node.text;
-        case "default_parameter":
-        case "typed_parameter":
-        case "typed_default_parameter":
-        case "list_splat_pattern":
-        case "dictionary_splat_pattern":
-            return node.namedChildren[0]?.text ?? null;
-        default:
-            return null;
-    }
-}
-function findFunctionNode(node) {
-    if (node.type === "function_definition" || node.type === "async_function_definition") {
-        return node;
-    }
-    for (const child of node.namedChildren) {
-        const found = findFunctionNode(child);
-        if (found)
-            return found;
-    }
-    return null;
-}
-function createSourcePath(sourceKind, symbol, node) {
-    return {
-        source: {
-            kind: sourceKind,
-            label: node.text,
-            file: symbol.file,
-            line: lineForNode(symbol, node),
-            symbol_name: symbol.name,
-            code: codeForNode(node),
-        },
-        hops: [],
-        heuristic: false,
-    };
-}
-function identifierPaths(env, name) {
-    return (env.get(name) ?? []).map(clonePath);
-}
-function isAllowedPattern(allowed, kind, label) {
-    if (allowed.length === 0)
-        return true;
-    return allowed.some((pattern) => pattern === kind
-        || label === pattern
-        || label.includes(pattern)
-        || kind.includes(pattern));
-}
-function buildSinkDescriptors() {
-    return [
-        {
-            kind: "redirect",
-            matches: (calleeText) => calleeText === "redirect"
-                || calleeText.endsWith(".redirect")
-                || calleeText === "HttpResponseRedirect"
-                || calleeText === "HttpResponsePermanentRedirect",
-            pickArgs: (args) => args[0] ? [args[0]] : [],
-        },
-        {
-            kind: "mark_safe",
-            matches: (calleeText) => calleeText === "mark_safe" || calleeText.endsWith(".mark_safe"),
-            pickArgs: (args) => args[0] ? [args[0]] : [],
-        },
-        {
-            kind: "cursor.execute",
-            matches: (calleeText) => calleeText === "cursor.execute" || calleeText.endsWith(".execute"),
-            pickArgs: (args) => args[0] ? [args[0]] : [],
-        },
-        {
-            kind: "subprocess",
-            matches: (calleeText) => calleeText.startsWith("subprocess.")
-                || calleeText.endsWith(".Popen")
-                || calleeText.endsWith(".run")
-                || calleeText.endsWith(".call")
-                || calleeText.endsWith(".check_call")
-                || calleeText.endsWith(".check_output"),
-            pickArgs: (args) => args[0] ? [args[0]] : [],
-        },
-        {
-            kind: "requests",
-            matches: (calleeText) => calleeText.startsWith("requests.")
-                || calleeText.includes(".requests.")
-                || calleeText.startsWith("httpx.")
-                || calleeText.includes(".httpx."),
-            pickArgs: (args) => {
-                if (args.length === 0)
-                    return [];
-                const urlKeyword = args.find((arg) => arg.keyword === "url");
-                if (urlKeyword)
-                    return [urlKeyword];
-                return args[1] ? [args[1]] : [args[0]];
-            },
-        },
-        {
-            kind: "httpx",
-            matches: (calleeText) => calleeText.startsWith("httpx.")
-                || calleeText.includes(".httpx."),
-            pickArgs: (args) => {
-                if (args.length === 0)
-                    return [];
-                const urlKeyword = args.find((arg) => arg.keyword === "url");
-                if (urlKeyword)
-                    return [urlKeyword];
-                return args[1] ? [args[1]] : [args[0]];
-            },
-        },
-        {
-            kind: "open",
-            matches: (calleeText) => calleeText === "open" || calleeText.endsWith(".open"),
-            pickArgs: (args) => args[0] ? [args[0]] : [],
-        },
-    ];
-}
-function getImportModule(node) {
-    const moduleNode = node.childForFieldName("module_name");
-    if (!moduleNode)
-        return { module: "", level: 0 };
-    if (moduleNode.type === "relative_import") {
-        let level = 0;
-        for (let i = 0; i < moduleNode.childCount; i++) {
-            const child = moduleNode.child(i);
-            if (!child)
-                continue;
-            if (child.type === "import_prefix") {
-                level += (child.text.match(/\./g) ?? []).length;
-            }
-            else if (child.type === ".") {
-                level += 1;
-            }
-        }
-        const dotted = moduleNode.namedChildren.find((child) => child.type === "dotted_name");
-        return { module: dotted?.text ?? "", level };
-    }
-    return { module: moduleNode.text, level: 0 };
-}
-async function loadFileContext(state, filePath) {
-    const cached = state.fileContextCache.get(filePath);
-    if (cached !== undefined)
-        return cached;
-    let source;
-    try {
-        source = await readFile(join(state.index.root, filePath), "utf-8");
-    }
-    catch {
-        state.fileContextCache.set(filePath, null);
-        return null;
-    }
-    const tree = state.pythonParser.parse(source);
-    if (!tree)
-        return null;
-    const files = state.index.files.map((entry) => entry.path);
-    const srcLayout = detectSrcLayout(files);
-    const imports = new Map();
-    for (const node of tree.rootNode.namedChildren) {
-        if (node.type !== "import_from_statement")
-            continue;
-        const { module, level } = getImportModule(node);
-        const resolvedFile = resolvePythonImport({ module, level }, filePath, files, srcLayout);
-        if (!resolvedFile)
-            continue;
-        for (const child of node.namedChildren) {
-            if (child.type === "aliased_import") {
-                const importedNode = child.namedChildren[0];
-                const aliasNode = child.namedChildren[1];
-                if (importedNode && aliasNode) {
-                    imports.set(aliasNode.text, {
-                        imported_name: importedNode.text,
-                        source_file: resolvedFile,
-                        line: node.startPosition.row + 1,
-                    });
-                }
-                continue;
-            }
-            if (child.type === "dotted_name") {
-                const importedName = child.text;
-                const localName = importedName.split(".").pop() ?? importedName;
-                imports.set(localName, {
-                    imported_name: importedName,
-                    source_file: resolvedFile,
-                    line: node.startPosition.row + 1,
-                });
-            }
-        }
-    }
-    const context = { imports };
-    state.fileContextCache.set(filePath, context);
-    return context;
-}
-function hasPotentialSource(symbol) {
-    return symbol.source?.includes("request.") ?? false;
-}
-function hasPotentialSink(symbol) {
-    const source = symbol.source ?? "";
-    return source.includes("mark_safe")
-        || source.includes("redirect(")
-        || source.includes(".execute(")
-        || source.includes("subprocess.")
-        || source.includes("requests.")
-        || source.includes("httpx.")
-        || source.includes("open(")
-        || source.includes("request.session");
-}
-async function loadCallableContext(symbol, state) {
-    const cached = state.callableCache.get(symbol.id);
-    if (cached !== undefined)
-        return cached;
-    if (!symbol.source) {
-        state.callableCache.set(symbol.id, null);
-        return null;
-    }
-    const tree = state.pythonParser.parse(symbol.source);
-    if (!tree)
-        return null;
-    const functionNode = findFunctionNode(tree.rootNode);
-    if (!functionNode) {
-        state.callableCache.set(symbol.id, null);
-        return null;
-    }
-    const paramsNode = functionNode.childForFieldName("parameters");
-    const parameterNames = paramsNode
-        ? paramsNode.namedChildren
-            .map(getParameterName)
-            .filter((name) => Boolean(name))
-        : [];
-    const context = {
-        node: functionNode,
-        parameter_names: parameterNames,
-    };
-    state.callableCache.set(symbol.id, context);
-    return context;
-}
-function resolveSelfMethod(currentSymbol, propertyName, state) {
-    if (!currentSymbol.parent)
-        return null;
-    const methods = state.methodsByParent.get(currentSymbol.parent) ?? [];
-    return methods.find((symbol) => symbol.name === propertyName) ?? null;
-}
-async function resolveHelperTarget(currentSymbol, calleeNode, state) {
-    const calleeText = getAttributePath(calleeNode) ?? calleeNode.text;
-    if (calleeNode.type === "identifier") {
-        const sameFile = (state.symbolsByName.get(calleeText) ?? [])
-            .filter((symbol) => symbol.file === currentSymbol.file
-            && symbol.id !== currentSymbol.id
-            && (symbol.kind === "function" || symbol.kind === "class" || symbol.kind === "method"));
-        if (sameFile.length === 1)
-            return sameFile[0];
-        const fileContext = await loadFileContext(state, currentSymbol.file);
-        const imported = fileContext?.imports.get(calleeText);
-        if (imported) {
-            const importedMatch = (state.symbolsByName.get(imported.imported_name) ?? [])
-                .find((symbol) => symbol.file === imported.source_file);
-            if (importedMatch)
-                return importedMatch;
-        }
-        const unique = (state.symbolsByName.get(calleeText) ?? [])
-            .filter((symbol) => symbol.file.endsWith(".py") && symbol.id !== currentSymbol.id)
-            .filter((symbol) => symbol.kind === "function" || symbol.kind === "method" || symbol.kind === "class");
-        if (unique.length === 1)
-            return unique[0];
-        return null;
-    }
-    if (calleeNode.type === "attribute") {
-        const objectNode = calleeNode.childForFieldName("object") ?? calleeNode.namedChild(0);
-        const propertyNode = calleeNode.childForFieldName("attribute") ?? calleeNode.namedChild(1);
-        const objectName = getAttributePath(objectNode);
-        const propertyName = propertyNode?.text;
-        if ((objectName === "self" || objectName === "cls") && propertyName) {
-            return resolveSelfMethod(currentSymbol, propertyName, state);
-        }
-        const importedModule = objectName ? (await loadFileContext(state, currentSymbol.file))?.imports.get(objectName) : null;
-        if (importedModule && propertyName) {
-            const candidates = state.symbolsByName.get(propertyName) ?? [];
-            const importedMatch = candidates.find((symbol) => symbol.file === importedModule.source_file);
-            if (importedMatch)
-                return importedMatch;
-        }
-    }
-    return null;
-}
-function matchesRequestSource(attributePath) {
-    if (!attributePath)
-        return null;
-    if (attributePath === "request.GET" || attributePath.startsWith("request.GET."))
-        return "request.GET";
-    if (attributePath === "request.POST" || attributePath.startsWith("request.POST."))
-        return "request.POST";
-    if (attributePath === "request.body")
-        return "request.body";
-    if (attributePath === "request.data" || attributePath.startsWith("request.data."))
-        return "request.data";
-    if (attributePath === "request.headers" || attributePath.startsWith("request.headers."))
-        return "request.headers";
-    if (attributePath === "request.COOKIES" || attributePath.startsWith("request.COOKIES."))
-        return "request.COOKIES";
-    if (attributePath === "request.META" || attributePath.startsWith("request.META."))
-        return "request.META";
-    return null;
-}
-function isSessionTarget(node) {
-    if (node.type === "attribute") {
-        const path = getAttributePath(node);
-        return path === "request.session";
-    }
-    if (node.type === "subscript") {
-        const base = node.childForFieldName("value") ?? node.namedChild(0);
-        return getAttributePath(base) === "request.session";
-    }
-    return false;
-}
-function sinkTraceKey(trace) {
-    return JSON.stringify({
-        entry_symbol: trace.entry_symbol,
-        entry_file: trace.entry_file,
-        source: trace.source,
-        sink: trace.sink,
-        hops: trace.hops,
-        heuristic: trace.heuristic,
-    });
-}
-function addTrace(state, entrySymbol, currentSymbol, sinkKind, sinkNode, paths) {
-    if (state.truncated)
-        return;
-    for (const path of paths) {
-        if (state.traces.length >= state.maxTraces) {
-            state.truncated = true;
-            return;
-        }
-        const trace = {
-            entry_symbol: entrySymbol.name,
-            entry_file: entrySymbol.file,
-            source: { ...path.source },
-            sink: {
-                kind: sinkKind,
-                label: sinkNode.text,
-                file: currentSymbol.file,
-                line: lineForNode(currentSymbol, sinkNode),
-                symbol_name: currentSymbol.name,
-                code: codeForNode(sinkNode),
-            },
-            hops: path.hops.map((hop) => ({ ...hop })),
-            confidence: computeConfidence(path),
-            heuristic: path.heuristic,
-        };
-        const key = sinkTraceKey(trace);
-        if (state.traceKeys.has(key))
-            continue;
-        state.traceKeys.add(key);
-        state.traces.push(trace);
-    }
-}
-async function evaluateExpression(node, symbol, env, state, context) {
-    switch (node.type) {
-        case "identifier":
-            return identifierPaths(env, node.text);
-        case "attribute": {
-            const sourceKind = matchesRequestSource(getAttributePath(node));
-            if (sourceKind)
-                return [createSourcePath(sourceKind, symbol, node)];
-            const objectNode = node.childForFieldName("object") ?? node.namedChild(0);
-            if (!objectNode)
-                return [];
-            const basePaths = await evaluateExpression(objectNode, symbol, env, state, context);
-            if (basePaths.length === 0)
-                return [];
-            return appendHop(basePaths, {
-                kind: "attribute",
-                file: symbol.file,
-                line: lineForNode(symbol, node),
-                symbol_name: symbol.name,
-                detail: `attribute access ${node.text}`,
-            });
-        }
-        case "subscript": {
-            const baseNode = node.childForFieldName("value") ?? node.namedChild(0);
-            const sourceKind = matchesRequestSource(getAttributePath(baseNode));
-            if (sourceKind)
-                return [createSourcePath(sourceKind, symbol, node)];
-            const basePaths = baseNode
-                ? await evaluateExpression(baseNode, symbol, env, state, context)
-                : [];
-            if (basePaths.length === 0)
-                return [];
-            return appendHop(basePaths, {
-                kind: "container",
-                file: symbol.file,
-                line: lineForNode(symbol, node),
-                symbol_name: symbol.name,
-                detail: `container access ${node.text}`,
-            });
-        }
-        case "string": {
-            const interpolated = node.namedChildren
-                .filter((child) => child.type === "interpolation")
-                .flatMap((child) => child.namedChildren);
-            if (interpolated.length === 0)
-                return [];
-            const paths = [];
-            for (const child of interpolated) {
-                paths.push(...await evaluateExpression(child, symbol, env, state, context));
-            }
-            if (paths.length === 0)
-                return [];
-            return appendHop(paths, {
-                kind: "container",
-                file: symbol.file,
-                line: lineForNode(symbol, node),
-                symbol_name: symbol.name,
-                detail: `formatted string ${node.text}`,
-            });
-        }
-        case "list":
-        case "tuple":
-        case "dictionary":
-        case "set": {
-            const paths = [];
-            for (const child of node.namedChildren) {
-                if (child.type === "pair") {
-                    const valueNode = child.namedChildren[1];
-                    if (!valueNode)
-                        continue;
-                    paths.push(...await evaluateExpression(valueNode, symbol, env, state, context));
-                }
-                else {
-                    paths.push(...await evaluateExpression(child, symbol, env, state, context));
-                }
-            }
-            if (paths.length === 0)
-                return [];
-            return appendHop(paths, {
-                kind: "container",
-                file: symbol.file,
-                line: lineForNode(symbol, node),
-                symbol_name: symbol.name,
-                detail: `container literal ${node.text}`,
-            });
-        }
-        case "binary_operator":
-        case "boolean_operator":
-        case "comparison_operator": {
-            const paths = [];
-            for (const child of node.namedChildren) {
-                paths.push(...await evaluateExpression(child, symbol, env, state, context));
-            }
-            return dedupePaths(paths);
-        }
-        case "parenthesized_expression":
-            return node.namedChildren[0]
-                ? await evaluateExpression(node.namedChildren[0], symbol, env, state, context)
-                : [];
-        case "conditional_expression": {
-            const paths = [];
-            for (const child of node.namedChildren) {
-                paths.push(...await evaluateExpression(child, symbol, env, state, context));
-            }
-            return dedupePaths(paths);
-        }
-        case "call": {
-            const calleeNode = node.childForFieldName("function") ?? node.namedChild(0);
-            const argsNode = node.childForFieldName("arguments") ?? node.namedChild(1);
-            const callArgs = getCallArguments(argsNode);
-            const calleeText = getAttributePath(calleeNode) ?? calleeNode?.text ?? "";
-            const sourceKind = matchesRequestSource(calleeText);
-            if (sourceKind && calleeText.endsWith(".get")) {
-                return [createSourcePath(sourceKind, symbol, node)];
-            }
-            const evaluatedArgs = await Promise.all(callArgs.map(async (arg) => ({
-                arg,
-                paths: await evaluateExpression(arg.node, symbol, env, state, context),
-            })));
-            for (const descriptor of state.sinkDescriptors) {
-                if (!descriptor.matches(calleeText))
-                    continue;
-                if (!isAllowedPattern(state.defaultSinks, descriptor.kind, calleeText))
-                    continue;
-                const selectedArgs = descriptor.pickArgs(callArgs);
-                const taintedArgs = selectedArgs.flatMap((selected) => evaluatedArgs
-                    .filter((entry) => entry.arg.index === selected.index)
-                    .flatMap((entry) => entry.paths));
-                if (taintedArgs.length > 0) {
-                    addTrace(state, context.entrySymbol, symbol, descriptor.kind, node, dedupePaths(taintedArgs));
-                }
-            }
-            const calleeLeaf = calleeText.split(".").pop() ?? calleeText;
-            if (KNOWN_SANITIZERS.has(calleeLeaf))
-                return [];
-            const taintedInputs = evaluatedArgs
-                .filter((entry) => entry.paths.length > 0)
-                .map((entry) => entry);
-            if (taintedInputs.length === 0)
-                return [];
-            const helperTarget = calleeNode
-                ? await resolveHelperTarget(symbol, calleeNode, state)
-                : null;
-            if (helperTarget && context.depth < state.maxDepth && !context.callStack.includes(helperTarget.id)) {
-                const helperContext = await loadCallableContext(helperTarget, state);
-                if (helperContext) {
-                    const helperEnv = new Map();
-                    for (const entry of taintedInputs) {
-                        const paramName = helperContext.parameter_names[entry.arg.index];
-                        if (!paramName)
-                            continue;
-                        helperEnv.set(paramName, appendHop(entry.paths, {
-                            kind: "call",
-                            file: symbol.file,
-                            line: lineForNode(symbol, node),
-                            symbol_name: symbol.name,
-                            detail: `call ${calleeText} -> parameter ${paramName}`,
-                        }));
-                    }
-                    const helperResult = await analyzeCallableSymbol(helperTarget, helperEnv, state, {
-                        entrySymbol: context.entrySymbol,
-                        depth: context.depth + 1,
-                        callStack: [...context.callStack, helperTarget.id],
-                    });
-                    if (helperResult.return_paths.length > 0) {
-                        return appendHop(helperResult.return_paths, {
-                            kind: "call",
-                            file: symbol.file,
-                            line: lineForNode(symbol, node),
-                            symbol_name: symbol.name,
-                            detail: `return from ${calleeText}`,
-                        });
-                    }
-                    return [];
-                }
-            }
-            return appendHop(taintedInputs.flatMap((entry) => entry.paths), {
-                kind: "call",
-                file: symbol.file,
-                line: lineForNode(symbol, node),
-                symbol_name: symbol.name,
-                detail: `heuristic propagation through ${calleeText}`,
-            }, { heuristic: true });
-        }
-        default:
-            return [];
-    }
-}
-async function analyzeAssignment(assignmentNode, symbol, env, state, context) {
-    const lhs = assignmentNode.childForFieldName("left") ?? assignmentNode.namedChild(0);
-    const rhs = assignmentNode.childForFieldName("right") ?? assignmentNode.namedChild(1);
-    const nextEnv = cloneEnv(env);
-    if (!lhs || !rhs)
-        return nextEnv;
-    const rhsPaths = await evaluateExpression(rhs, symbol, env, state, context);
-    if (rhsPaths.length === 0)
-        return nextEnv;
-    if (lhs.type === "identifier") {
-        nextEnv.set(lhs.text, appendHop(rhsPaths, {
-            kind: "assignment",
-            file: symbol.file,
-            line: lineForNode(symbol, assignmentNode),
-            symbol_name: symbol.name,
-            detail: `${lhs.text} = ${rhs.text}`,
-        }));
-        return nextEnv;
-    }
-    if (isSessionTarget(lhs) && isAllowedPattern(state.defaultSinks, "session-write", lhs.text)) {
-        addTrace(state, context.entrySymbol, symbol, "session-write", assignmentNode, rhsPaths);
-    }
-    return nextEnv;
-}
-async function analyzeConditionalLike(node, symbol, env, state, context) {
-    const conditionNodes = node.namedChildren.filter((child) => child.type !== "block" && child.type !== "else_clause" && child.type !== "elif_clause");
-    for (const condition of conditionNodes) {
-        await evaluateExpression(condition, symbol, env, state, context);
-    }
-    const branchResults = [];
-    let hasElseLike = false;
-    for (const child of node.namedChildren) {
-        if (child.type === "block") {
-            branchResults.push(await analyzeBlock(child, symbol, cloneEnv(env), state, context));
-            continue;
-        }
-        if (child.type === "elif_clause") {
-            hasElseLike = true;
-            branchResults.push(await analyzeConditionalLike(child, symbol, cloneEnv(env), state, context));
-            continue;
-        }
-        if (child.type === "else_clause") {
-            hasElseLike = true;
-            const elseBlock = child.namedChildren.find((grandchild) => grandchild.type === "block");
-            if (elseBlock)
-                branchResults.push(await analyzeBlock(elseBlock, symbol, cloneEnv(env), state, context));
-        }
-    }
-    const baseEnvs = hasElseLike ? [] : [env];
-    return {
-        env: mergeEnvs(...baseEnvs, ...branchResults.map((entry) => entry.env)),
-        return_paths: dedupePaths(branchResults.flatMap((entry) => entry.return_paths)),
-    };
-}
-async function analyzeLoopLike(node, symbol, env, state, context) {
-    for (const child of node.namedChildren) {
-        if (child.type === "block")
-            continue;
-        await evaluateExpression(child, symbol, env, state, context);
-    }
-    const blockResults = [];
-    for (const child of node.namedChildren) {
-        if (child.type !== "block")
-            continue;
-        blockResults.push(await analyzeBlock(child, symbol, cloneEnv(env), state, context));
-    }
-    return {
-        env: mergeEnvs(env, ...blockResults.map((entry) => entry.env)),
-        return_paths: dedupePaths(blockResults.flatMap((entry) => entry.return_paths)),
-    };
-}
-async function analyzeStatement(node, symbol, env, state, context) {
-    switch (node.type) {
-        case "expression_statement": {
-            const inner = node.namedChildren[0];
-            if (!inner)
-                return { env, return_paths: [] };
-            if (inner.type === "assignment") {
-                return {
-                    env: await analyzeAssignment(inner, symbol, env, state, context),
-                    return_paths: [],
-                };
-            }
-            await evaluateExpression(inner, symbol, env, state, context);
-            return { env, return_paths: [] };
-        }
-        case "return_statement": {
-            const valueNode = node.namedChildren[0];
-            if (!valueNode)
-                return { env, return_paths: [] };
-            const valuePaths = await evaluateExpression(valueNode, symbol, env, state, context);
-            if (valuePaths.length === 0)
-                return { env, return_paths: [] };
-            return {
-                env,
-                return_paths: appendHop(valuePaths, {
-                    kind: "return",
-                    file: symbol.file,
-                    line: lineForNode(symbol, node),
-                    symbol_name: symbol.name,
-                    detail: `return ${valueNode.text}`,
-                }),
-            };
-        }
-        case "if_statement":
-        case "elif_clause":
-            return await analyzeConditionalLike(node, symbol, env, state, context);
-        case "for_statement":
-        case "while_statement":
-        case "with_statement":
-        case "try_statement":
-            return await analyzeLoopLike(node, symbol, env, state, context);
-        case "pass_statement":
-        case "break_statement":
-        case "continue_statement":
-            return { env, return_paths: [] };
-        case "function_definition":
-        case "async_function_definition":
-        case "class_definition":
-        case "decorated_definition":
-            return { env, return_paths: [] };
-        default: {
-            for (const child of node.namedChildren) {
-                if (child.type === "block") {
-                    await analyzeBlock(child, symbol, cloneEnv(env), state, context);
-                }
-                else {
-                    await evaluateExpression(child, symbol, env, state, context);
-                }
-            }
-            return { env, return_paths: [] };
-        }
-    }
-}
-async function analyzeBlock(blockNode, symbol, env, state, context) {
-    let currentEnv = cloneEnv(env);
-    let returnPaths = [];
-    for (const child of blockNode.namedChildren) {
-        if (state.truncated)
-            break;
-        const result = await analyzeStatement(child, symbol, currentEnv, state, context);
-        currentEnv = result.env;
-        if (result.return_paths.length > 0) {
-            returnPaths = dedupePaths([...returnPaths, ...result.return_paths]);
-        }
-    }
-    return {
-        env: currentEnv,
-        return_paths: returnPaths,
-    };
-}
-async function analyzeCallableSymbol(symbol, initialEnv, state, context) {
-    const callableContext = await loadCallableContext(symbol, state);
-    if (!callableContext) {
-        return { env: initialEnv, return_paths: [] };
-    }
-    const bodyNode = callableContext.node.childForFieldName("body");
-    if (!bodyNode) {
-        return { env: initialEnv, return_paths: [] };
-    }
-    return await analyzeBlock(bodyNode, symbol, initialEnv, state, context);
-}
-function shouldAnalyzeSymbol(symbol, filePattern) {
-    if (!symbol.file.endsWith(".py"))
-        return false;
-    if (filePattern && !symbol.file.includes(filePattern))
-        return false;
-    if (!symbol.source)
-        return false;
-    if (symbol.kind !== "function" && symbol.kind !== "method")
-        return false;
-    return hasPotentialSource(symbol) || hasPotentialSink(symbol);
-}
+import { DEFAULT_MAX_DEPTH, DEFAULT_MAX_TRACES, DEFAULT_SINK_PATTERNS, DEFAULT_SOURCE_PATTERNS, buildSinkDescriptors, isAllowedPattern, } from "./taint/taint-model.js";
+import { analyzeCallableSymbol, shouldAnalyzeSymbol, } from "./taint/taint-analyzer.js";
 function buildState(index, pythonParser, options) {
     const symbolsByName = new Map();
     const methodsByParent = new Map();