cognium-dev 3.167.0 → 3.173.0

package/dist/cli.js

@@ -6861,33 +6861,33 @@ function detectLanguage2(tree) {
     return "python";
   return jsScore > javaScore ? "javascript" : "java";
 }
-function extractImports(tree, language) {
+function extractImports(tree, language, cache) {
   const effectiveLanguage = language ?? detectLanguage2(tree);
   const isJavaScript = effectiveLanguage === "javascript" || effectiveLanguage === "typescript" || effectiveLanguage === "tsx";
   const isPython = effectiveLanguage === "python";
   const isRust = effectiveLanguage === "rust";
   if (effectiveLanguage === "go") {
-    return extractGoImports(tree);
+    return extractGoImports(tree, cache);
   }
   if (isRust) {
-    return extractRustImports(tree);
+    return extractRustImports(tree, cache);
   }
   if (isPython) {
-    return extractPythonImports(tree);
+    return extractPythonImports(tree, cache);
   }
   if (isJavaScript) {
-    return extractJavaScriptImports(tree);
+    return extractJavaScriptImports(tree, cache);
   }
-  return extractJavaImports(tree);
+  return extractJavaImports(tree, cache);
 }
-function extractJavaScriptImports(tree) {
+function extractJavaScriptImports(tree, cache) {
   const imports = [];
-  const importStatements = findNodes(tree.rootNode, "import_statement");
+  const importStatements = getNodesFromCache(tree.rootNode, "import_statement", cache);
   for (const importStmt of importStatements) {
     const importInfos = extractJSImportInfo(importStmt);
     imports.push(...importInfos);
   }
-  const exportStatements = findNodes(tree.rootNode, "export_statement");
+  const exportStatements = getNodesFromCache(tree.rootNode, "export_statement", cache);
   for (const exportStmt of exportStatements) {
     const sourceNode = exportStmt.childForFieldName("source");
     if (!sourceNode)
@@ -6903,13 +6903,13 @@ function extractJavaScriptImports(tree) {
       line_number: exportStmt.startPosition.row + 1
     });
   }
-  const requireCalls = findRequireCalls(tree);
+  const requireCalls = findRequireCalls(tree, cache);
   imports.push(...requireCalls);
   return imports;
 }
-function extractJavaImports(tree) {
+function extractJavaImports(tree, cache) {
   const imports = [];
-  const importDecls = findNodes(tree.rootNode, "import_declaration");
+  const importDecls = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const importDecl of importDecls) {
     const importInfo = extractJavaImportInfo(importDecl);
     if (importInfo) {
@@ -7061,9 +7061,9 @@ function extractJSImportInfo(node) {
   }
   return imports;
 }
-function findRequireCalls(tree) {
+function findRequireCalls(tree, cache) {
   const imports = [];
-  const callExpressions = findNodes(tree.rootNode, "call_expression");
+  const callExpressions = getNodesFromCache(tree.rootNode, "call_expression", cache);
   for (const call of callExpressions) {
     const funcNode = call.childForFieldName("function");
     if (!funcNode || getNodeText(funcNode) !== "require")
@@ -7182,14 +7182,14 @@ function parseImportPath(fullPath, isWildcard) {
     fromPackage: fullPath.substring(0, lastDot)
   };
 }
-function extractPythonImports(tree) {
+function extractPythonImports(tree, cache) {
   const imports = [];
-  const importStatements = findNodes(tree.rootNode, "import_statement");
+  const importStatements = getNodesFromCache(tree.rootNode, "import_statement", cache);
   for (const stmt of importStatements) {
     const importInfos = extractPythonImportStatement(stmt);
     imports.push(...importInfos);
   }
-  const importFromStatements = findNodes(tree.rootNode, "import_from_statement");
+  const importFromStatements = getNodesFromCache(tree.rootNode, "import_from_statement", cache);
   for (const stmt of importFromStatements) {
     const importInfos = extractPythonFromImportStatement(stmt);
     imports.push(...importInfos);
@@ -7285,9 +7285,9 @@ function extractPythonFromImportStatement(node) {
   }
   return imports;
 }
-function extractRustImports(tree) {
+function extractRustImports(tree, cache) {
   const imports = [];
-  const useDecls = findNodes(tree.rootNode, "use_declaration");
+  const useDecls = getNodesFromCache(tree.rootNode, "use_declaration", cache);
   for (const useDecl of useDecls) {
     const useImports = extractRustUseDecl(useDecl);
     imports.push(...useImports);
@@ -7433,9 +7433,9 @@ function extractRustScopedUseList(node, lineNumber) {
   }
   return imports;
 }
-function extractGoImports(tree) {
+function extractGoImports(tree, cache) {
   const imports = [];
-  const importDecls = findNodes(tree.rootNode, "import_declaration");
+  const importDecls = getNodesFromCache(tree.rootNode, "import_declaration", cache);
   for (const decl of importDecls) {
     const singleSpec = findGoChildByType(decl, "import_spec");
     if (singleSpec) {
@@ -7576,7 +7576,7 @@ function detectLanguage3(tree) {
   }
   return jsScore > javaScore ? "javascript" : "java";
 }
-function buildCFG(tree, language) {
+function buildCFG(tree, language, cache) {
   const effectiveLanguage = language ?? detectLanguage3(tree);
   const isJavaScript = effectiveLanguage === "javascript" || effectiveLanguage === "typescript" || effectiveLanguage === "tsx";
   const allBlocks = [];
@@ -7590,11 +7590,11 @@ function buildCFG(tree, language) {
   }
   if (isJavaScript) {
     const functions = [
-      ...findNodes(tree.rootNode, "function_declaration"),
-      ...findNodes(tree.rootNode, "arrow_function"),
-      ...findNodes(tree.rootNode, "method_definition"),
-      ...findNodes(tree.rootNode, "function"),
-      ...findNodes(tree.rootNode, "function_expression")
+      ...getNodesFromCache(tree.rootNode, "function_declaration", cache),
+      ...getNodesFromCache(tree.rootNode, "arrow_function", cache),
+      ...getNodesFromCache(tree.rootNode, "method_definition", cache),
+      ...getNodesFromCache(tree.rootNode, "function", cache),
+      ...getNodesFromCache(tree.rootNode, "function_expression", cache)
     ];
     for (const func2 of functions) {
       const body2 = func2.childForFieldName("body");
@@ -7617,8 +7617,8 @@ function buildCFG(tree, language) {
     }
   } else {
     const methods = [
-      ...findNodes(tree.rootNode, "method_declaration"),
-      ...findNodes(tree.rootNode, "constructor_declaration")
+      ...getNodesFromCache(tree.rootNode, "method_declaration", cache),
+      ...getNodesFromCache(tree.rootNode, "constructor_declaration", cache)
     ];
     for (const method of methods) {
       const body2 = method.childForFieldName("body");
@@ -10507,7 +10507,51 @@ var DEFAULT_SOURCES = [
   { method: "recv", class: "TcpStream", type: "network_input", severity: "high", return_tainted: true },
   { method: "read", class: "TcpStream", type: "network_input", severity: "high", return_tainted: true },
   { method: "read_to_end", class: "TcpStream", type: "network_input", severity: "high", return_tainted: true },
-  { method: "read_to_string", class: "TcpStream", type: "network_input", severity: "high", return_tainted: true }
+  { method: "read_to_string", class: "TcpStream", type: "network_input", severity: "high", return_tainted: true },
+  { method_annotation: "Query", type: "http_body", severity: "high", languages: ["javascript", "typescript"] },
+  { method_annotation: "Mutation", type: "http_body", severity: "high", languages: ["javascript", "typescript"] },
+  { method_annotation: "Subscription", type: "http_body", severity: "high", languages: ["javascript", "typescript"] },
+  { method_annotation: "FieldResolver", type: "http_body", severity: "high", languages: ["javascript", "typescript"] },
+  { method_annotation: "ResolveField", type: "http_body", severity: "high", languages: ["javascript", "typescript"] },
+  { annotation: "Arg", type: "http_param", severity: "high", param_tainted: true, languages: ["javascript", "typescript"] },
+  { annotation: "Args", type: "http_param", severity: "high", param_tainted: true, languages: ["javascript", "typescript"] },
+  { method_annotation: "strawberry.field", type: "http_body", severity: "high", languages: ["python"] },
+  { method_annotation: "strawberry.mutation", type: "http_body", severity: "high", languages: ["python"] },
+  { method_annotation: "strawberry.subscription", type: "http_body", severity: "high", languages: ["python"] },
+  { method_annotation: "DgsQuery", type: "http_body", severity: "high", languages: ["java"] },
+  { method_annotation: "DgsMutation", type: "http_body", severity: "high", languages: ["java"] },
+  { method_annotation: "DgsSubscription", type: "http_body", severity: "high", languages: ["java"] },
+  { method_annotation: "DgsData", type: "http_body", severity: "high", languages: ["java"] },
+  { method_annotation: "GraphQLQuery", type: "http_body", severity: "high", languages: ["java"] },
+  { method_annotation: "GraphQLMutation", type: "http_body", severity: "high", languages: ["java"] },
+  { annotation: "InputArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { annotation: "GraphQLArgument", type: "http_param", severity: "high", param_tainted: true, languages: ["java"] },
+  { method: "invocation_metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "get", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "getMap", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "FromIncomingContext", class: "metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] },
+  { method: "get", class: "Metadata", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
+  { method: "get", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
+  { method: "hget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
+  { method: "mget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
+  { method: "lrange", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
+  { method: "get", class: "cache", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
+  { method: "get_many", class: "cache", type: "db_input", severity: "medium", return_tainted: true, languages: ["python"] },
+  { method: "get", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "hget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "mget", class: "Redis", type: "db_input", severity: "medium", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "get", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  { method: "hget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  { method: "mget", class: "Jedis", type: "db_input", severity: "medium", return_tainted: true, languages: ["java"] },
+  { method: "decode", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "get_unverified_claims", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "get_unverified_header", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["python"] },
+  { method: "decode", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "decode", class: "jsonwebtoken", type: "http_header", severity: "high", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "decodeJwt", class: "jose", type: "http_header", severity: "high", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "decodeProtectedHeader", class: "jose", type: "http_header", severity: "high", return_tainted: true, languages: ["javascript", "typescript"] },
+  { method: "decode", class: "JWT", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
+  { method: "ParseUnverified", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] }
 ];
 var DEFAULT_SINKS = [
   { method: "executeQuery", class: "Statement", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -11995,6 +12039,9 @@ function findSources(calls, types, patterns, sourceLines, language) {
       for (const param of method.parameters) {
         for (const pattern of patterns) {
           if (pattern.annotation && pattern.param_tainted) {
+            if (pattern.languages && pattern.languages.length > 0 && language !== undefined && !pattern.languages.includes(language)) {
+              continue;
+            }
             if (matchesAnnotation(param.annotations, pattern.annotation)) {
               const paramLine = param.line ?? method.start_line;
               sources.push({
@@ -12016,6 +12063,9 @@ function findSources(calls, types, patterns, sourceLines, language) {
       for (const pattern of patterns) {
         if (!pattern.method_annotation)
           continue;
+        if (pattern.languages && pattern.languages.length > 0 && language !== undefined && !pattern.languages.includes(language)) {
+          continue;
+        }
         if (!matchesAnnotation(method.annotations, pattern.method_annotation))
           continue;
         for (const param of method.parameters) {
@@ -12269,7 +12319,7 @@ function isParameterizedQueryCall(call, pattern) {
     const secondArg = call.arguments.find((a) => a.position === 1);
     if (secondArg?.expression) {
       const expr = secondArg.expression.trim();
-      if (expr.startsWith("[")) {
+      if (expr.startsWith("[") && !/^\[\s*\]$/.test(expr)) {
         return true;
       }
     }
@@ -12757,52 +12807,75 @@ function matchesSourcePattern(call, pattern) {
   }
   return false;
 }
+var JS_SOURCE_PATTERN_CACHE = new WeakMap;
+var JS_FALLBACK_COMPILED = (() => {
+  const bases = [
+    { base: "req\\.params", sourceType: "http_param" },
+    { base: "req\\.query", sourceType: "http_param" },
+    { base: "req\\.body", sourceType: "http_body" },
+    { base: "req\\.headers", sourceType: "http_header" },
+    { base: "req\\.cookies", sourceType: "http_cookie" },
+    { base: "req\\.url", sourceType: "http_path" },
+    { base: "req\\.path", sourceType: "http_path" },
+    { base: "req\\.originalUrl", sourceType: "http_path" },
+    { base: "req\\.file", sourceType: "file_input" },
+    { base: "req\\.files", sourceType: "file_input" },
+    { base: "request\\.params", sourceType: "http_param" },
+    { base: "request\\.query", sourceType: "http_param" },
+    { base: "request\\.body", sourceType: "http_body" },
+    { base: "request\\.headers", sourceType: "http_header" },
+    { base: "process\\.env", sourceType: "env_input" },
+    { base: "process\\.argv", sourceType: "io_input" },
+    { base: "ctx\\.query", sourceType: "http_param" },
+    { base: "ctx\\.params", sourceType: "http_param" },
+    { base: "ctx\\.request", sourceType: "http_body" }
+  ];
+  const exact = [];
+  const contained = [];
+  for (const { base, sourceType } of bases) {
+    exact.push({ pattern: new RegExp(`^${base}\\b`), sourceType });
+    contained.push({ pattern: new RegExp(`\\b${base}\\b`), sourceType });
+  }
+  return { exact, contained };
+})();
+function compileJsSourcePatterns(sourcePatterns) {
+  const cached = JS_SOURCE_PATTERN_CACHE.get(sourcePatterns);
+  if (cached)
+    return cached;
+  const exact = [];
+  const contained = [];
+  for (const sp of sourcePatterns) {
+    if (sp.property && sp.object && sp.property_tainted) {
+      exact.push({
+        pattern: new RegExp(`^${sp.object}\\.${sp.property}\\b`),
+        sourceType: sp.type
+      });
+      contained.push({
+        pattern: new RegExp(`\\b${sp.object}\\.${sp.property}\\b`),
+        sourceType: sp.type
+      });
+    }
+  }
+  const compiled = { exact, contained };
+  JS_SOURCE_PATTERN_CACHE.set(sourcePatterns, compiled);
+  return compiled;
+}
 function isJavaScriptTaintedArgument(argExpression, sourcePatterns) {
-  const exactPatterns = [];
-  const containedPatterns = [];
-  if (sourcePatterns) {
-    for (const sp of sourcePatterns) {
-      if (sp.property && sp.object && sp.property_tainted) {
-        const exactRegex = new RegExp(`^${sp.object}\\.${sp.property}\\b`);
-        exactPatterns.push({ pattern: exactRegex, sourceType: sp.type });
-        const containedRegex = new RegExp(`\\b${sp.object}\\.${sp.property}\\b`);
-        containedPatterns.push({ pattern: containedRegex, sourceType: sp.type });
-      }
-    }
-  }
-  if (exactPatterns.length === 0) {
-    const basePatterns = [
-      { base: "req\\.params", sourceType: "http_param" },
-      { base: "req\\.query", sourceType: "http_param" },
-      { base: "req\\.body", sourceType: "http_body" },
-      { base: "req\\.headers", sourceType: "http_header" },
-      { base: "req\\.cookies", sourceType: "http_cookie" },
-      { base: "req\\.url", sourceType: "http_path" },
-      { base: "req\\.path", sourceType: "http_path" },
-      { base: "req\\.originalUrl", sourceType: "http_path" },
-      { base: "req\\.file", sourceType: "file_input" },
-      { base: "req\\.files", sourceType: "file_input" },
-      { base: "request\\.params", sourceType: "http_param" },
-      { base: "request\\.query", sourceType: "http_param" },
-      { base: "request\\.body", sourceType: "http_body" },
-      { base: "request\\.headers", sourceType: "http_header" },
-      { base: "process\\.env", sourceType: "env_input" },
-      { base: "process\\.argv", sourceType: "io_input" },
-      { base: "ctx\\.query", sourceType: "http_param" },
-      { base: "ctx\\.params", sourceType: "http_param" },
-      { base: "ctx\\.request", sourceType: "http_body" }
-    ];
-    for (const { base, sourceType } of basePatterns) {
-      exactPatterns.push({ pattern: new RegExp(`^${base}\\b`), sourceType });
-      containedPatterns.push({ pattern: new RegExp(`\\b${base}\\b`), sourceType });
+  let compiled;
+  if (sourcePatterns && sourcePatterns.length > 0) {
+    compiled = compileJsSourcePatterns(sourcePatterns);
+    if (compiled.exact.length === 0) {
+      compiled = JS_FALLBACK_COMPILED;
     }
+  } else {
+    compiled = JS_FALLBACK_COMPILED;
   }
-  for (const { pattern, sourceType } of exactPatterns) {
+  for (const { pattern, sourceType } of compiled.exact) {
     if (pattern.test(argExpression)) {
       return { isTainted: true, sourceType };
     }
   }
-  for (const { pattern, sourceType } of containedPatterns) {
+  for (const { pattern, sourceType } of compiled.contained) {
     if (pattern.test(argExpression)) {
       return { isTainted: true, sourceType };
     }
@@ -13624,6 +13697,66 @@ function formatCallCode(call) {
   }
   return `${call.method_name}(${args2})`;
 }
+// ../circle-ir/dist/analysis/non-executable-lines.js
+function isNonExecutableSourceLine(sourceCode, line, language) {
+  if (!sourceCode || line < 1)
+    return false;
+  const lines = sourceCode.split(`
+`);
+  if (line > lines.length)
+    return false;
+  const raw = lines[line - 1] ?? "";
+  const trimmed = raw.trim();
+  if (trimmed === "")
+    return true;
+  const lang = language.toLowerCase();
+  if (trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*/") || trimmed.startsWith("*") || trimmed === "/**") {
+    return true;
+  }
+  switch (lang) {
+    case "java":
+    case "javascript":
+    case "typescript":
+    case "go":
+    case "rust":
+      return isNonExecutableCurly(trimmed);
+    case "python":
+      return isNonExecutablePython(trimmed);
+    default:
+      return false;
+  }
+}
+function isNonExecutableCurly(trimmed) {
+  if (/^(import|package|use|from)\s/.test(trimmed))
+    return true;
+  if (/^@[A-Za-z_][\w.]*(?:\s*\([^)]*\))?\s*$/.test(trimmed))
+    return true;
+  if (/^(?:(?:public|private|protected|internal)\s+)?(?:static\s+)?(?:final\s+|readonly\s+|const\s+)(?:[A-Za-z_][\w<>.\[\]]*\s+)?[A-Za-z_]\w*(?:\s*:\s*[^=]+)?\s*=\s*(?:["'`][^"'`]*["'`]|-?\d+(?:\.\d+)?)\s*;?\s*$/.test(trimmed)) {
+    return true;
+  }
+  if (/^(?:const|let|var|static)\s+[A-Za-z_]\w*(?:\s*:\s*[^=]+)?\s*=\s*(?:["'`][^"'`]*["'`]|-?\d+(?:\.\d+)?)\s*;?\s*$/.test(trimmed)) {
+    return true;
+  }
+  if (/^(?:(?:public|private|protected)\s+)?(?:static\s+)?(?:final\s+)[A-Za-z_][\w<>.\[\]]*\s+[A-Za-z_]\w*\s*;\s*$/.test(trimmed)) {
+    return true;
+  }
+  return false;
+}
+function isNonExecutablePython(trimmed) {
+  if (/^(import|from)\s/.test(trimmed))
+    return true;
+  if (trimmed.startsWith("#"))
+    return true;
+  if (trimmed === '"""' || trimmed === "'''")
+    return true;
+  if (/^@[A-Za-z_][\w.]*(?:\s*\([^)]*\))?\s*$/.test(trimmed))
+    return true;
+  if (/^[A-Z_][A-Z0-9_]*\s*(?::\s*[^=]+)?\s*=\s*(?:["'][^"']*["']|-?\d+(?:\.\d+)?)\s*$/.test(trimmed)) {
+    return true;
+  }
+  return false;
+}
+
 // ../circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
@@ -15874,6 +16007,20 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   return { visited, lines, hopCapReached };
 }
 
+// ../circle-ir/dist/analysis/sanitizer-index.js
+var SANITIZER_SET_CACHE = new WeakMap;
+function getSanitizesSet(san) {
+  let s = SANITIZER_SET_CACHE.get(san);
+  if (!s) {
+    s = new Set(san.sanitizes);
+    SANITIZER_SET_CACHE.set(san, s);
+  }
+  return s;
+}
+function sanitizerCoversSink(san, sinkType) {
+  return getSanitizesSet(san).has(sinkType);
+}
+
 // ../circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
@@ -16095,7 +16242,7 @@ function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
     for (const san of sanitizersAtTarget) {
       if (isKnownSinkType) {
-        if (san.sanitizes.includes(sinkType)) {
+        if (sanitizerCoversSink(san, sinkType)) {
           return { sanitized: true, sanitizer: san };
         }
       } else if (san.sanitizes.length > 0) {
@@ -16115,7 +16262,7 @@ function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
         continue;
       for (const san of sansAtLine) {
         if (isKnownSinkType) {
-          if (san.sanitizes.includes(sinkType)) {
+          if (sanitizerCoversSink(san, sinkType)) {
             return { sanitized: true, sanitizer: san };
           }
         } else if (san.sanitizes.length > 0) {
@@ -23133,7 +23280,7 @@ class CrossFilePass {
         for (const san of sinkIR.taint.sanitizers ?? []) {
           if (san.line < lo || san.line > hi)
             continue;
-          if (san.sanitizes.includes(sinkTypeStr)) {
+          if (sanitizerCoversSink(san, sinkTypeStr)) {
             return false;
           }
         }
@@ -23142,7 +23289,7 @@ class CrossFilePass {
       for (const san of sinkIR.taint.sanitizers ?? []) {
         if (san.line !== tp.sink.line)
           continue;
-        if (san.sanitizes.includes(sinkTypeStr)) {
+        if (sanitizerCoversSink(san, sinkTypeStr)) {
           return false;
         }
       }
@@ -30930,7 +31077,8 @@ class SinkFilterPass {
     const taintMatcher = ctx.getResult("taint-matcher");
     const constProp = ctx.getResult("constant-propagation");
     const langSources = ctx.getResult("language-sources");
-    const sources = [...taintMatcher.sources, ...langSources.additionalSources];
+    const mergedSources = [...taintMatcher.sources, ...langSources.additionalSources];
+    const sources = ctx.code && ctx.language ? mergedSources.filter((s) => !isNonExecutableSourceLine(ctx.code, s.line, ctx.language)) : mergedSources;
     const sinks = [...taintMatcher.sinks];
     for (const s of langSources.additionalSinks) {
       if (!sinks.some((x) => x.line === s.line && x.cwe === s.cwe && x.type === s.type)) {
@@ -32022,7 +32170,7 @@ function filterSanitizedSinks(sinks, sanitizers, calls) {
     if (!lineSanitizers || lineSanitizers.length === 0)
       return true;
     for (const san of lineSanitizers) {
-      if (san.sanitizes.includes(sink.type)) {
+      if (sanitizerCoversSink(san, sink.type)) {
         const lineCalls = callsByLine.get(sink.line) ?? [];
         for (const call of lineCalls) {
           for (const arg of call.arguments) {
@@ -32512,15 +32660,25 @@ class TaintPropagationPass {
       confidence: flow.confidence,
       sanitized: flow.sanitized
     }));
+    const flowKey = (x) => `${x.source_line}|${x.sink_line}|${x.sink_type}`;
+    const flowKeys = new Set;
+    for (const x of flows)
+      flowKeys.add(flowKey(x));
+    const pushIfNew = (f) => {
+      const k = flowKey(f);
+      if (flowKeys.has(k))
+        return false;
+      flowKeys.add(k);
+      flows.push(f);
+      return true;
+    };
     const arrayFlows = detectArrayElementFlows(calls, sources, sinks, constProp.taintedArrayElements, constProp.unreachableLines, types) ?? [];
     for (const f of arrayFlows) {
-      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type)) {
-        flows.push(f);
-      }
+      pushIfNew(f);
     }
     const collectionFlows = detectCollectionFlows(calls, sources, sinks, constProp.tainted, constProp.unreachableLines, ctx.code, types) ?? [];
     for (const f of collectionFlows) {
-      if (flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type))
+      if (flowKeys.has(flowKey(f)))
         continue;
       const flowForCheck = {
         source: { line: f.source_line },
@@ -32538,17 +32696,15 @@ class TaintPropagationPass {
       }
       if (isFP)
         continue;
-      flows.push(f);
+      pushIfNew(f);
     }
     const paramFlows = detectParameterSinkFlows(types, calls, sources, sinks, constProp.unreachableLines, constProp.tainted, ctx.code) ?? [];
     for (const f of paramFlows) {
-      if (!flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type)) {
-        flows.push(f);
-      }
+      pushIfNew(f);
     }
     const exprScanFlows = detectExpressionScanFlows(calls, sources, sinks, sanitizers, constProp.unreachableLines, constProp.tainted, ctx.code, ctx.language) ?? [];
     for (const f of exprScanFlows) {
-      if (flows.some((x) => x.source_line === f.source_line && x.sink_line === f.sink_line && x.sink_type === f.sink_type))
+      if (flowKeys.has(flowKey(f)))
         continue;
       const flowForCheck = {
         source: { line: f.source_line },
@@ -32566,7 +32722,7 @@ class TaintPropagationPass {
       }
       if (isFP)
         continue;
-      flows.push(f);
+      pushIfNew(f);
     }
     const sanitizedNames = constProp.sanitizedVars;
     let finalFlows = sanitizedNames.size === 0 ? flows : flows.filter((f) => {
@@ -32599,7 +32755,7 @@ class TaintPropagationPass {
             if (!sansAtLine)
               continue;
             for (const san of sansAtLine) {
-              if (san.sanitizes.includes(f.sink_type)) {
+              if (sanitizerCoversSink(san, f.sink_type)) {
                 return false;
               }
             }
@@ -32609,7 +32765,7 @@ class TaintPropagationPass {
         const sansAtSink = sanitizersByLine.get(f.sink_line);
         if (sansAtSink && sansAtSink.length > 0) {
           for (const san of sansAtSink) {
-            if (san.sanitizes.includes(f.sink_type)) {
+            if (sanitizerCoversSink(san, f.sink_type)) {
               return false;
             }
           }
@@ -32635,7 +32791,7 @@ class TaintPropagationPass {
             if (!sansAtLine || sansAtLine.length === 0)
               continue;
             for (const san of sansAtLine) {
-              if (san.sanitizes.includes(f.sink_type)) {
+              if (sanitizerCoversSink(san, f.sink_type)) {
                 return false;
               }
             }
@@ -34178,7 +34334,7 @@ class InterproceduralPass {
             if (!sansAtLine)
               continue;
             for (const san of sansAtLine) {
-              if (san.sanitizes.includes(f.sink_type)) {
+              if (sanitizerCoversSink(san, f.sink_type)) {
                 sanitizedSinkKeys.add(`${f.sink_line}:${f.sink_type}`);
                 return false;
               }
@@ -34190,7 +34346,7 @@ class InterproceduralPass {
         if (!sansAtSink || sansAtSink.length === 0)
           return true;
         for (const san of sansAtSink) {
-          if (san.sanitizes.includes(f.sink_type)) {
+          if (sanitizerCoversSink(san, f.sink_type)) {
             return false;
           }
         }
@@ -43428,7 +43584,9 @@ function getNodeTypesForLanguage(language) {
         "jsx_self_closing_element",
         "jsx_opening_element",
         "jsx_attribute",
-        "jsx_expression"
+        "jsx_expression",
+        "function",
+        "function_expression"
       ]);
     case "bash":
       return new Set([
@@ -43482,7 +43640,9 @@ function getNodeTypesForLanguage(language) {
         "field_declaration",
         "import_declaration",
         "interface_declaration",
-        "enum_declaration"
+        "enum_declaration",
+        "package_declaration",
+        "local_variable_declaration"
       ]);
   }
 }
@@ -43540,10 +43700,21 @@ async function analyze(code, filePath, language, options = {}) {
     }
   }
   logger.debug("Analyzing file", { filePath, language, parseGrammar, codeLength: code.length });
+  const phaseTimingEnabled = globalThis.__circleIrPassTiming === true;
+  const phaseStart = () => phaseTimingEnabled ? Date.now() : 0;
+  const phaseEnd = (label, t0) => {
+    if (!phaseTimingEnabled)
+      return;
+    console.error(`[phase-timing] ${label} ${Date.now() - t0}ms file=${filePath}`);
+  };
+  const tParse = phaseStart();
   const tree = await parse(code, parseGrammar);
+  phaseEnd("parse", tParse);
   try {
     logger.trace("Parsed AST", { rootNodeType: tree.rootNode.type });
+    const tParseStatus = phaseStart();
     const parseStatus = extractParseStatus(tree);
+    phaseEnd("extractParseStatus", tParseStatus);
     if (parseStatus.has_errors) {
       logger.warn("Partial parse — IR may be incomplete", {
         filePath,
@@ -43552,18 +43723,37 @@ async function analyze(code, filePath, language, options = {}) {
         firstErrorLine: parseStatus.error_locations[0]?.line
       });
     }
+    const tCollect = phaseStart();
     const nodeCache = collectAllNodes(tree.rootNode, getNodeTypesForLanguage(language));
+    phaseEnd("collectAllNodes", tCollect);
+    const tMeta = phaseStart();
     const meta = extractMeta(code, tree, filePath, language);
     if (options.projectProfile !== undefined) {
       meta.projectProfile = makeProfileResolver2(options.projectProfile)(filePath);
     }
+    phaseEnd("extractMeta", tMeta);
+    const tTypes = phaseStart();
     const types = extractTypes(tree, nodeCache, language);
+    phaseEnd("extractTypes", tTypes);
+    const tCalls = phaseStart();
     const calls = extractCalls(tree, nodeCache, language);
-    const imports = extractImports(tree, language);
+    phaseEnd("extractCalls", tCalls);
+    const tImports = phaseStart();
+    const imports = extractImports(tree, language, nodeCache);
+    phaseEnd("extractImports", tImports);
+    const tExports = phaseStart();
     const exports = extractExports(types);
-    const cfg = buildCFG(tree, language);
+    phaseEnd("extractExports", tExports);
+    const tCFG = phaseStart();
+    const cfg = buildCFG(tree, language, nodeCache);
+    phaseEnd("buildCFG", tCFG);
+    const tDFG = phaseStart();
     const dfg = buildDFG(tree, nodeCache, language);
+    phaseEnd("buildDFG", tDFG);
+    const tRuntime = phaseStart();
     const runtimeRegistrations = extractRuntimeRegistrations(tree, nodeCache, language, imports);
+    phaseEnd("extractRuntimeRegistrations", tRuntime);
+    const tGraph = phaseStart();
     const graph = new CodeGraph({
       meta,
       types,
@@ -43576,6 +43766,7 @@ async function analyze(code, filePath, language, options = {}) {
       unresolved: [],
       enriched: {}
     });
+    phaseEnd("buildCodeGraph", tGraph);
     const config = options.taintConfig ?? getDefaultConfig();
     const disabledPasses = new Set(options.disabledPasses ?? []);
     const passOpts = options.passOptions ?? {};
@@ -44534,7 +44725,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.167.0";
+var version = "3.173.0";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.167.0",
+  "version": "3.173.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "^1.1.0",
-    "circle-ir": "^3.167.0"
+    "circle-ir": "^3.173.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",