cognium-dev 3.140.0 → 3.145.0

package/dist/cli.js

@@ -5668,6 +5668,12 @@ function resolveReceiverType(receiver, context) {
   }
   if (receiver === "super")
     return { simpleName: null, fqn: null };
+  const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+  if (ctorMatch) {
+    const ctorClass = ctorMatch[1];
+    const simple = ctorClass.includes(".") ? ctorClass.substring(ctorClass.lastIndexOf(".") + 1) : ctorClass;
+    return resolveFqn(simple, context);
+  }
   const declaredType = context.localVarTypes.get(receiver) ?? context.paramTypes.get(receiver) ?? context.fieldTypes.get(receiver);
   if (declaredType) {
     return resolveFqn(stripGenerics(declaredType), context);
@@ -5678,19 +5684,48 @@ function resolveReceiverType(receiver, context) {
       return resolveFqn(simple, context);
     }
   }
-  const chained = receiver.match(/^([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)\s*\([^()]*\)$/);
-  if (chained) {
-    const varName = chained[1];
-    const methodName = chained[2];
-    const varType = context.localVarTypes.get(varName) ?? context.paramTypes.get(varName) ?? context.fieldTypes.get(varName);
-    if (varType) {
-      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[stripGenerics(varType)]?.[methodName];
+  const chain = splitChainedReceiver(receiver);
+  if (chain) {
+    const prefixType = resolveReceiverType(chain.prefix, context);
+    if (prefixType.simpleName) {
+      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[prefixType.simpleName]?.[chain.methodName];
       if (returnType)
         return resolveFqn(returnType, context);
     }
   }
   return { simpleName: null, fqn: null };
 }
+function splitChainedReceiver(receiver) {
+  if (!receiver.endsWith(")"))
+    return null;
+  let depth = 0;
+  let openIdx = -1;
+  for (let i2 = receiver.length - 1;i2 >= 0; i2--) {
+    const c = receiver[i2];
+    if (c === ")")
+      depth++;
+    else if (c === "(") {
+      depth--;
+      if (depth === 0) {
+        openIdx = i2;
+        break;
+      }
+    }
+  }
+  if (openIdx <= 0)
+    return null;
+  const beforeParen = receiver.substring(0, openIdx);
+  const dotIdx = beforeParen.lastIndexOf(".");
+  if (dotIdx <= 0)
+    return null;
+  const methodName = beforeParen.substring(dotIdx + 1).trim();
+  if (!/^[A-Za-z_$][\w$]*$/.test(methodName))
+    return null;
+  const prefix = beforeParen.substring(0, dotIdx).trim();
+  if (!prefix)
+    return null;
+  return { prefix, methodName };
+}
 var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
   HttpServletRequest: {
     getSession: "HttpSession",
@@ -5702,6 +5737,31 @@ var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
   },
   ServletContext: {
     getRequestDispatcher: "RequestDispatcher"
+  },
+  DocumentBuilderFactory: {
+    newInstance: "DocumentBuilderFactory",
+    newDocumentBuilder: "DocumentBuilder"
+  },
+  SAXParserFactory: {
+    newInstance: "SAXParserFactory",
+    newSAXParser: "SAXParser"
+  },
+  SAXParser: {
+    getXMLReader: "XMLReader"
+  },
+  XPathFactory: {
+    newInstance: "XPathFactory",
+    newXPath: "XPath"
+  },
+  TransformerFactory: {
+    newInstance: "TransformerFactory",
+    newTransformer: "Transformer"
+  },
+  XMLInputFactory: {
+    newInstance: "XMLInputFactory",
+    newFactory: "XMLInputFactory",
+    createXMLStreamReader: "XMLStreamReader",
+    createXMLEventReader: "XMLEventReader"
   }
 };
 function resolveFqn(simpleName, context) {
@@ -10678,6 +10738,8 @@ var DEFAULT_SINKS = [
   { method: "sendError", class: "HttpServletResponse", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "setHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
   { method: "addHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
+  { method: "Cookie", class: "constructor", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0, 1] },
+  { method: "addCookie", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0] },
   { method: "setContentType", class: "HttpServletResponse", type: "xss", cwe: "CWE-79", severity: "medium", arg_positions: [0] },
   { method: "setAttribute", class: "PageContext", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
   { method: "addAttribute", class: "Model", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
@@ -11614,11 +11676,62 @@ var DEFAULT_SANITIZERS = [
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
 ];
+var DEFAULT_SINK_SEMANTICS = [
+  {
+    signature: "Jedis#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Redis wire-protocol serialization, not OS exec"
+  },
+  {
+    signature: "Connection#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis abstract Connection base"
+  },
+  {
+    signature: "JedisCluster#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis cluster client"
+  },
+  {
+    signature: "Func1#exec",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection", "code_injection"],
+    note: "RxJava functional dispatch, not OS exec"
+  },
+  {
+    signature: "Action0#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action0 dispatch"
+  },
+  {
+    signature: "Action1#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action1 dispatch"
+  },
+  {
+    signature: "Unsafe#defineAnonymousClass",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "sun.misc.Unsafe JDK-internal reflective bridge"
+  },
+  {
+    signature: "MethodHandle#invokeExact",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "java.lang.invoke.MethodHandle — JDK-internal"
+  }
+];
 function getDefaultConfig() {
   return {
     sources: DEFAULT_SOURCES,
     sinks: DEFAULT_SINKS,
-    sanitizers: DEFAULT_SANITIZERS
+    sanitizers: DEFAULT_SANITIZERS,
+    sinkSemantics: DEFAULT_SINK_SEMANTICS
   };
 }
 var DEFAULT_HEADER_RULES = [
@@ -11947,7 +12060,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
             severity: "medium",
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
-            in_method: method.name
+            in_method: method.name,
+            ...language === "java" ? { variable: param.name } : {}
           });
         }
       }
@@ -12445,7 +12559,19 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   return false;
 }
 var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
-function isSafeJinjaRenderCall(call, pattern, language) {
+var JINJA_AUTOESCAPE_TRUE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*True\b/;
+var JINJA_SELECT_AUTOESCAPE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*select_autoescape\s*\(/;
+var JINJA_AUTOESCAPE_FALSE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False\b/;
+function fileHasSafeJinjaEnvironment(sourceLines) {
+  if (!sourceLines || sourceLines.length === 0)
+    return false;
+  const text = sourceLines.join(`
+`);
+  if (JINJA_AUTOESCAPE_FALSE_RE.test(text))
+    return false;
+  return JINJA_AUTOESCAPE_TRUE_RE.test(text) || JINJA_SELECT_AUTOESCAPE_RE.test(text);
+}
+function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   if (language !== "python")
     return false;
   if (pattern.type !== "xss" && pattern.type !== "code_injection")
@@ -12461,7 +12587,10 @@ function isSafeJinjaRenderCall(call, pattern, language) {
   }
   if (method === "render") {
     const receiver = (call.receiver ?? "").trim();
-    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+    if (TEMPLATE_LITERAL_RECEIVER_RE.test(receiver))
+      return true;
+    if (fileHasSafeJinjaEnvironment(sourceLines))
+      return true;
   }
   return false;
 }
@@ -12509,7 +12638,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
-        if (isSafeJinjaRenderCall(call, pattern, language)) {
+        if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
         const location = formatCallLocation(call);
@@ -12517,6 +12646,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
+          const receiverType = call.receiver_type;
+          const simpleClass = receiverType ? receiverType.split(".").pop() || undefined : undefined;
           sinkMap.set(key, {
             type: pattern.type,
             cwe: pattern.cwe,
@@ -12524,7 +12655,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             line: call.location.line,
             confidence,
             method: call.method_name,
-            argPositions: pattern.arg_positions
+            argPositions: pattern.arg_positions,
+            class: simpleClass
           });
         }
       }
@@ -13424,12 +13556,12 @@ function formatCallCode(call) {
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization"],
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization"],
     io_input: ["command_injection", "path_traversal", "deserialization", "xxe", "code_injection", "xss", "ssrf"],
     env_input: ["command_injection", "path_traversal"],
     db_input: ["xss", "sql_injection"],
@@ -13442,6 +13574,15 @@ function canSourceReachSink(sourceType, sinkType) {
   const validSinks = sourceToSinkMapping[sourceType];
   return validSinks ? validSinks.includes(sinkType) : false;
 }
+function sourceSemanticsAllowed(source, sinkType) {
+  if (source.constant === true) {
+    return false;
+  }
+  if (source.spi === true) {
+    return sinkType === "code_injection";
+  }
+  return true;
+}
 
 // ../circle-ir/dist/analysis/findings-instrumentation.js
 var instrumentEnabled = false;
@@ -23548,6 +23689,68 @@ function buildRustTaintedVars(sourceCode, seedVars) {
   }
   return derived;
 }
+function buildJavaTaintedVars(sourceCode, seedVars) {
+  const derived = new Map;
+  const knownTainted = new Set(seedVars);
+  const lines = sourceCode.split(`
+`);
+  const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const JAVA_KEYWORDS = new Set([
+    "if",
+    "else",
+    "while",
+    "for",
+    "do",
+    "switch",
+    "case",
+    "return",
+    "throw",
+    "try",
+    "catch",
+    "finally",
+    "new",
+    "this",
+    "super",
+    "break",
+    "continue",
+    "default",
+    "class",
+    "interface",
+    "enum"
+  ]);
+  let changed = true;
+  let guard = 0;
+  while (changed && guard < lines.length + 2) {
+    changed = false;
+    guard++;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      const line = lines[i2];
+      const trimmed = line.trimStart();
+      if (trimmed.startsWith("//") || trimmed.startsWith("*"))
+        continue;
+      const declMatch = declRe.exec(line);
+      const assignMatch = !declMatch ? assignRe.exec(line) : null;
+      const m = declMatch ?? assignMatch;
+      if (!m)
+        continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (JAVA_KEYWORDS.has(lhs))
+        continue;
+      if (knownTainted.has(lhs))
+        continue;
+      const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const ref = [...knownTainted].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhs));
+      if (ref) {
+        derived.set(lhs, i2 + 1);
+        knownTainted.add(lhs);
+        changed = true;
+      }
+    }
+  }
+  return derived;
+}
 var BASH_POSITIONAL_PARAMS = new Set(["1", "2", "3", "4", "5", "6", "7", "8", "9", "@", "*"]);
 var BASH_UNTRUSTED_ENV_PATTERNS = [
   /^USER_INPUT$/i,
@@ -23928,7 +24131,7 @@ function findBashRealpathPrefixGuardSanitizers(code) {
   const caseOpen = /^\s*case\s+"?\$\{?\w+\}?"?\s+in\b/;
   const esacClose = /^\s*esac\b/;
   const armOpener = /^\s*([^)\s][^)]*?)\)/;
-  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|[\w\-./]+)(?:\/|\*)/;
+  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|https?:\/\/[\w\-.]+|[\w\-./]+)(?:\/|\*)/;
   const catchAllArm = /^(?:\*|\\\*)$/;
   let i2 = 0;
   while (i2 < lines.length) {
@@ -24861,10 +25064,13 @@ function findJavaArgvFormExecSanitizers(code) {
 `);
   const argvExecRe = /\.\s*exec\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
   const argvPbRe = /\bnew\s+ProcessBuilder\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+  const shellInStringRe = /new\s+String\s*\[\s*\]\s*\{\s*"(?:\/(?:usr\/)?bin\/(?:sh|bash|zsh|ksh|dash)|(?:sh|bash|zsh|ksh|dash)|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)"\s*,\s*"(?:-c|\/c|-Command|-command)"/i;
   for (let i2 = 0;i2 < lines.length; i2++) {
     const text = lines[i2];
     if (!argvExecRe.test(text) && !argvPbRe.test(text))
       continue;
+    if (shellInStringRe.test(text))
+      continue;
     sanitizers.push({
       type: "java_argv_form_exec",
       method: "exec",
@@ -27015,6 +27221,20 @@ function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
   }
   return findings;
 }
+function hasHostAllowlistBeforeSink(taintedVars, lines, sinkLineIdx) {
+  for (let i2 = 0;i2 < sinkLineIdx; i2++) {
+    const t = lines[i2];
+    for (const v of taintedVars) {
+      const containsRe = new RegExp(`\\.\\s*contains\\s*\\(\\s*${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\)`);
+      if (containsRe.test(t))
+        return true;
+      const equalsRe = new RegExp(`\\b${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\.\\s*equals(?:IgnoreCase)?\\s*\\(\\s*"[^"]+"\\s*\\)`);
+      if (equalsRe.test(t))
+        return true;
+    }
+  }
+  return false;
+}
 function findJavaUrlOpenStreamSsrfFindings(code, file) {
   const findings = [];
   if (typeof code !== "string" || code.length === 0)
@@ -27079,6 +27299,8 @@ function findJavaUrlOpenStreamSsrfFindings(code, file) {
     }
     if (!tainted)
       continue;
+    if (hasHostAllowlistBeforeSink(taintedVars, lines, i2))
+      continue;
     const key = `${i2 + 1}:${op}`;
     if (seen.has(key))
       continue;
@@ -28389,6 +28611,94 @@ function findJsTemplateInjectionSstiFindings(code, file) {
   return findings;
 }
 
+// ../circle-ir/dist/analysis/passes/source-semantics-pass.js
+var DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
+var CONST_STRING_ASSIGN_RE = /^\s*(?:final\s+|static\s+final\s+)?[A-Za-z_][\w.<>\[\]]*\s+[A-Za-z_]\w*\s*=\s*"[^"]*"\s*;?\s*$/;
+var STATIC_FINAL_RE = /^\s*(?:public\s+|private\s+|protected\s+)?static\s+final\s+/;
+var ENUM_CONST_REF_RE = /=\s*[A-Z][A-Za-z0-9_]*\.[A-Z][A-Z0-9_]*\s*;?\s*$/;
+function isConstantSource(code) {
+  if (!code)
+    return false;
+  if (CONST_STRING_ASSIGN_RE.test(code))
+    return true;
+  if (STATIC_FINAL_RE.test(code)) {
+    const rhs = code.split("=").slice(1).join("=").trim();
+    if (rhs.length === 0)
+      return false;
+    if (/^"[^"]*"\s*;?\s*$/.test(rhs))
+      return true;
+    if (/^-?\d+(?:\.\d+)?[fFdDlL]?\s*;?\s*$/.test(rhs))
+      return true;
+    if (/^(?:true|false)\s*;?\s*$/.test(rhs))
+      return true;
+    if (/^[A-Za-z_][\w.]*\s*;?\s*$/.test(rhs))
+      return true;
+    return false;
+  }
+  if (ENUM_CONST_REF_RE.test(code))
+    return true;
+  return false;
+}
+var SERVICE_LOADER_RE = /\bServiceLoader\.(?:load|loadInstalled|stream)\s*\(/;
+var CLASS_FOR_NAME_RE = /\bClass\.forName\s*\(/;
+var META_INF_SERVICES_RE = /getResources?\s*\(\s*"META-INF\/services\//;
+var SPI_WINDOW = 30;
+function isSpiSource(source, lines) {
+  const code = source.code;
+  if (!code)
+    return false;
+  if (SERVICE_LOADER_RE.test(code))
+    return true;
+  if (CLASS_FOR_NAME_RE.test(code)) {
+    const start2 = Math.max(0, source.line - 1 - SPI_WINDOW);
+    const end = Math.min(lines.length, source.line - 1 + SPI_WINDOW + 1);
+    for (let i2 = start2;i2 < end; i2++) {
+      if (META_INF_SERVICES_RE.test(lines[i2]))
+        return true;
+    }
+  }
+  return false;
+}
+function isDemoPathFile(file) {
+  if (!file)
+    return false;
+  return DEMO_PATH_RE.test(file);
+}
+
+class SourceSemanticsPass {
+  name = "source-semantics";
+  category = "security";
+  run(ctx) {
+    const { graph, code } = ctx;
+    const sources = graph.ir.taint.sources;
+    if (sources.length === 0) {
+      return { constantCount: 0, spiCount: 0, demoPathCount: 0 };
+    }
+    const file = graph.ir.meta.file;
+    const demoPath = isDemoPathFile(file);
+    const lines = code.split(`
+`);
+    let constantCount = 0;
+    let spiCount = 0;
+    let demoPathCount = 0;
+    for (const source of sources) {
+      if (isConstantSource(source.code)) {
+        source.constant = true;
+        constantCount++;
+      }
+      if (isSpiSource(source, lines)) {
+        source.spi = true;
+        spiCount++;
+      }
+      if (demoPath) {
+        source.demoPath = true;
+        demoPathCount++;
+      }
+    }
+    return { constantCount, spiCount, demoPathCount };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/sink-filter-pass.js
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
@@ -28970,7 +29280,7 @@ class SinkFilterPass {
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection")
           return true;
-        if (sink.method !== "ProcessBuilder")
+        if (sink.method !== "ProcessBuilder" && sink.method !== "start")
           return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
         if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText))
@@ -29807,6 +30117,54 @@ function filterSanitizedSinks(sinks, sanitizers, calls) {
   });
 }
 
+// ../circle-ir/dist/analysis/passes/sink-semantics-pass.js
+function buildRegistry(entries) {
+  const registry = new Map;
+  for (const entry of entries) {
+    const existing = registry.get(entry.signature);
+    if (existing) {
+      for (const t of entry.overrides)
+        existing.add(t);
+    } else {
+      registry.set(entry.signature, new Set(entry.overrides));
+    }
+  }
+  return registry;
+}
+
+class SinkSemanticsPass {
+  name = "sink-semantics";
+  category = "security";
+  run(ctx) {
+    const { graph, config } = ctx;
+    const entries = config.sinkSemantics ?? [];
+    if (entries.length === 0) {
+      return { droppedCount: 0, registrySize: 0 };
+    }
+    const registry = buildRegistry(entries);
+    const sinks = graph.ir.taint.sinks;
+    let droppedCount = 0;
+    const kept = sinks.filter((sink) => {
+      if (!sink.class || !sink.method)
+        return true;
+      const signature = `${sink.class}#${sink.method}`;
+      const overrides = registry.get(signature);
+      if (!overrides)
+        return true;
+      if (overrides.has(sink.type)) {
+        droppedCount++;
+        return false;
+      }
+      return true;
+    });
+    if (droppedCount > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedCount, registrySize: registry.size };
+  }
+}
+
 // ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
@@ -30501,6 +30859,27 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  if (language === "java" && typeof code === "string" && sourcesWithVar.length > 0) {
+    const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
+    const derived = buildJavaTaintedVars(code, seedVars);
+    if (derived.size > 0) {
+      let anchor = sourcesWithVar[0];
+      for (const s of sourcesWithVar) {
+        if (s.line < anchor.line)
+          anchor = s;
+      }
+      const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
+      for (const [varName] of derived) {
+        if (!varName || existingVars.has(varName))
+          continue;
+        sourcesWithVar.push({
+          ...anchor,
+          variable: varName
+        });
+        existingVars.add(varName);
+      }
+    }
+  }
   const reCache = new Map;
   for (const s of sourcesWithVar) {
     if (reCache.has(s.variable))
@@ -30535,6 +30914,8 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           const re = reCache.get(source.variable);
           if (!re || !re.test(expr))
             continue;
+          if (!sourceSemanticsAllowed(source, sink.type))
+            continue;
           if (flows.some((f) => f.source_line === source.line && f.sink_line === sink.line && f.sink_type === sink.type))
             continue;
           if (aliasSanitizedFor.get(source.variable)?.has(sink.type)) {
@@ -30562,8 +30943,6 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
   }
   const sourcesByLine = new Map;
   for (const s of sources) {
-    if (s.variable && s.variable.length > 0)
-      continue;
     const arr = sourcesByLine.get(s.line) ?? [];
     arr.push(s);
     sourcesByLine.set(s.line, arr);
@@ -30577,6 +30956,20 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     for (const source of colocSources) {
       if (!canSourceReachSink(source.type, sink.type))
         continue;
+      if (!sourceSemanticsAllowed(source, sink.type))
+        continue;
+      const sourceVar = source.variable;
+      if (sourceVar && sourceVar.length > 0) {
+        const sinkCode = sink.code;
+        if (!sinkCode) {
+          continue;
+        }
+        const assignMatch = sinkCode.match(/^\s*(?:[A-Za-z_][\w.<>[\]\s,?]*\s+)?[A-Za-z_]\w*\s*=(?!=)\s*/);
+        const rhs = assignMatch ? sinkCode.slice(assignMatch[0].length) : sinkCode;
+        if (new RegExp(`\\b${sourceVar}\\b`).test(rhs)) {
+          continue;
+        }
+      }
       if (source.type === "file_input" && sink.type === "path_traversal" && sink.method && source.location.includes(`${sink.method}(`)) {
         continue;
       }
@@ -31165,7 +31558,9 @@ var TIER_1_METHOD_ANNOTATIONS = new Set([
   "DELETE",
   "PATCH",
   "HEAD",
-  "OPTIONS"
+  "OPTIONS",
+  "DataBoundConstructor",
+  "DataBoundSetter"
 ]);
 var TIER_1_CLASS_ANNOTATIONS = new Set([
   "RestController",
@@ -31190,7 +31585,13 @@ var TIER_1_BY_SUPERTYPE = new Map([
   ["ChannelInboundHandler", new Set(["channelRead", "channelReadComplete"])],
   ["ChannelInboundHandlerAdapter", new Set(["channelRead", "channelReadComplete"])],
   ["ChannelDuplexHandler", new Set(["channelRead", "channelReadComplete"])],
-  ["NettyRequestProcessor", new Set(["process"])]
+  ["NettyRequestProcessor", new Set(["process"])],
+  ["Converter", new Set(["marshal", "unmarshal"])],
+  ["SingleValueConverter", new Set(["fromString", "toString"])],
+  ["ConverterMatcher", new Set(["marshal", "unmarshal"])],
+  ["AbstractReflectionConverter", new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
+  ["AbstractSingleValueConverter", new Set(["fromString", "toString"])],
+  ["AbstractCollectionConverter", new Set(["marshal", "unmarshal"])]
 ]);
 var TIER_3_CLASS_SUFFIXES = [
   "Util",
@@ -35700,6 +36101,14 @@ function isProtocolMandatedCryptoFile(file, code) {
 }
 
 // ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
+function applyDemoDowngrade(demoPath, severity, level) {
+  if (!demoPath)
+    return { severity, level };
+  if (severity === "high") {
+    return { severity: "low", level: "note" };
+  }
+  return { severity, level };
+}
 var TEST_PATH_RE3 = /(?:^|[\\/])(?:test|tests|spec|specs|__tests?__|__mocks?__|fixtures?|testdata)(?:[\\/]|$)/i;
 var TEST_FILENAME_RE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|_test\.go|_test\.py|Test\.java|Tests\.java)$/i;
 function isTestFile(file) {
@@ -36050,6 +36459,7 @@ class ScanSecretsPass {
     if (isTestFile(file) || isGeneratedFile(file)) {
       return { providerFindings: 0, entropyFindings: 0 };
     }
+    const demoPath = DEMO_PATH_RE.test(file);
     const lines = ctx.code.split(`
 `);
     const prior = ctx.getFindings?.() ?? [];
@@ -36080,14 +36490,15 @@ class ScanSecretsPass {
         if (seen.has(key))
           continue;
         seen.add(key);
+        const dg = applyDemoDowngrade(demoPath, pattern.severity, pattern.level);
         ctx.addFinding({
           id: `hardcoded-credential-${file}-${lineNum}`,
           pass: this.name,
           category: this.category,
           rule_id: "hardcoded-credential",
           cwe: "CWE-798",
-          severity: pattern.severity,
-          level: pattern.level,
+          severity: dg.severity,
+          level: dg.level,
           message: `Hardcoded credential: ${pattern.name} detected`,
           file,
           line: lineNum,
@@ -36109,14 +36520,15 @@ class ScanSecretsPass {
       if (seen.has(key))
         continue;
       seen.add(key);
+      const dg = applyDemoDowngrade(demoPath, "high", "error");
       ctx.addFinding({
         id: `hardcoded-credential-${file}-${lineNum}`,
         pass: this.name,
         category: this.category,
         rule_id: "hardcoded-credential",
         cwe: "CWE-798",
-        severity: "high",
-        level: "error",
+        severity: dg.severity,
+        level: dg.level,
         message: `Hardcoded credential: \`${hit.name}\` assigned a literal value`,
         file,
         line: lineNum,
@@ -40737,7 +41149,11 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new TaintMatcherPass);
     pipeline.add(new ConstantPropagationPass(tree));
     pipeline.add(new LanguageSourcesPass);
+    if (!disabledPasses.has("source-semantics"))
+      pipeline.add(new SourceSemanticsPass);
     pipeline.add(new SinkFilterPass);
+    if (!disabledPasses.has("sink-semantics"))
+      pipeline.add(new SinkSemanticsPass);
     pipeline.add(new TaintPropagationPass);
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
@@ -41665,7 +42081,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.140.0";
+var version = "3.145.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.140.0",
+  "version": "3.145.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.140.0"
+    "circle-ir": "^3.145.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",