cognium-dev 3.37.0 → 3.39.0

package/dist/cli.js

@@ -18050,6 +18050,7 @@ class CrossFileResolver {
   typeHierarchy;
   fileIRs = new Map;
   methodTaintInfo = new Map;
+  fieldTaintInfo = new Map;
   resolvedCalls = new Map;
   constructor(symbolTable, typeHierarchy) {
     this.symbolTable = symbolTable;
@@ -18060,6 +18061,7 @@ class CrossFileResolver {
     this.symbolTable.addFromIR(ir, filePath);
     this.typeHierarchy.addFromIR(ir, filePath);
     this.analyzeMethodTaint(ir, filePath);
+    this.analyzeFieldTaint(ir, filePath);
   }
   resolveCall(call, fromFile) {
     const cacheKey = `${fromFile}:${call.location.line}:${call.method_name}`;
@@ -18226,6 +18228,113 @@ class CrossFileResolver {
       }
     }
   }
+  analyzeFieldTaint(ir, filePath) {
+    const pkg = ir.meta.package || "";
+    const ctorFieldRe = /^(\w+)\.(\w+)\(\) returns tainted field '([^']+)' \(from constructor param '([^']+)'\)/;
+    for (const src of ir.taint.sources) {
+      if (src.type !== "constructor_field")
+        continue;
+      const m = ctorFieldRe.exec(src.location);
+      if (!m)
+        continue;
+      const [, className, , fieldName, sourceParam] = m;
+      const typeFqn = pkg ? `${pkg}.${className}` : className;
+      const type = ir.types.find((t) => t.name === className);
+      if (!type)
+        continue;
+      const writerMethod = type.methods.find((mth) => mth.name === className && mth.parameters.some((p) => p.name === sourceParam)) ?? type.methods.find((mth) => mth.parameters.some((p) => p.name === sourceParam));
+      if (!writerMethod)
+        continue;
+      const field = type.fields?.find((f) => f.name === fieldName);
+      const key = `${typeFqn}.${fieldName}`;
+      const existing = this.fieldTaintInfo.get(key);
+      const writer = {
+        methodFqn: `${typeFqn}.${writerMethod.name}`,
+        methodName: writerMethod.name,
+        writeLine: writerMethod.start_line,
+        sourceType: "constructor_field",
+        sourceLine: src.line
+      };
+      if (existing) {
+        if (!existing.writers.some((w) => w.methodFqn === writer.methodFqn)) {
+          existing.writers.push(writer);
+        }
+      } else {
+        this.fieldTaintInfo.set(key, {
+          typeFqn,
+          fieldName,
+          fieldType: field?.type ?? null,
+          file: filePath,
+          writers: [writer]
+        });
+      }
+    }
+    for (const type of ir.types) {
+      const typeFqn = pkg ? `${pkg}.${type.name}` : type.name;
+      for (const method of type.methods) {
+        if (!method.name.startsWith("set") || method.name.length <= 3)
+          continue;
+        if (method.parameters.length !== 1)
+          continue;
+        const fieldName = method.name.charAt(3).toLowerCase() + method.name.substring(4);
+        const field = type.fields?.find((f) => f.name === fieldName);
+        if (!field)
+          continue;
+        const key = `${typeFqn}.${fieldName}`;
+        const writer = {
+          methodFqn: `${typeFqn}.${method.name}`,
+          methodName: method.name,
+          writeLine: method.start_line,
+          sourceType: "setter_param",
+          sourceLine: method.start_line
+        };
+        const existing = this.fieldTaintInfo.get(key);
+        if (existing) {
+          if (!existing.writers.some((w) => w.methodFqn === writer.methodFqn)) {
+            existing.writers.push(writer);
+          }
+        } else {
+          this.fieldTaintInfo.set(key, {
+            typeFqn,
+            fieldName,
+            fieldType: field.type ?? null,
+            file: filePath,
+            writers: [writer]
+          });
+        }
+      }
+    }
+    const injectAnnotations = new Set(["Autowired", "Inject", "Resource"]);
+    for (const type of ir.types) {
+      const typeFqn = pkg ? `${pkg}.${type.name}` : type.name;
+      for (const field of type.fields ?? []) {
+        if (!field.annotations?.some((a) => injectAnnotations.has(a)))
+          continue;
+        const key = `${typeFqn}.${field.name}`;
+        const writer = {
+          methodFqn: `${typeFqn}.<injected>`,
+          methodName: "<injected>",
+          writeLine: type.start_line,
+          sourceType: "autowired_field",
+          sourceLine: type.start_line
+        };
+        const existing = this.fieldTaintInfo.get(key);
+        if (existing) {
+          if (!existing.writers.some((w) => w.methodFqn === writer.methodFqn)) {
+            existing.writers.push(writer);
+          }
+        } else {
+          this.fieldTaintInfo.set(key, {
+            typeFqn,
+            fieldName: field.name,
+            fieldType: field.type ?? null,
+            file: filePath,
+            writers: [writer]
+          });
+        }
+      }
+    }
+  }
   isMethodTaintSource(method, sources) {
     const sourceAnnotations = ["RequestParam", "RequestBody", "PathVariable", "QueryParam"];
     for (const param of method.parameters) {
@@ -18234,6 +18343,8 @@ class CrossFileResolver {
       }
     }
     for (const source of sources) {
+      if (source.type === "interprocedural_param")
+        continue;
       if (source.line >= method.start_line && source.line <= method.end_line) {
         return true;
       }
@@ -18242,6 +18353,8 @@ class CrossFileResolver {
   }
   getSourceType(method, sources) {
     for (const source of sources) {
+      if (source.type === "interprocedural_param")
+        continue;
       if (source.line >= method.start_line && source.line <= method.end_line) {
         return source.type;
       }
@@ -18249,15 +18362,45 @@ class CrossFileResolver {
     return;
   }
   findTaintedParams(method, ir) {
-    const taintedParams = [];
+    const taintedParams = new Set;
     const numParams = method.parameters.length;
     for (let i2 = 0;i2 < numParams; i2++) {
       const param = method.parameters[i2];
       if (param.annotations.some((a) => ["RequestParam", "RequestBody", "PathVariable"].includes(a))) {
-        taintedParams.push(i2);
+        taintedParams.add(i2);
       }
     }
-    return taintedParams;
+    const paramNameToIndex = new Map;
+    for (let i2 = 0;i2 < numParams; i2++) {
+      const name2 = method.parameters[i2].name;
+      if (name2)
+        paramNameToIndex.set(name2, i2);
+    }
+    for (const sink of ir.taint.sinks) {
+      if (sink.line < method.start_line || sink.line > method.end_line)
+        continue;
+      const callsAtSink = ir.calls.filter((c) => c.location.line === sink.line);
+      for (const call of callsAtSink) {
+        for (const arg of call.arguments) {
+          const candidates = [];
+          if (arg.variable)
+            candidates.push(arg.variable);
+          if (arg.expression) {
+            for (const [name2] of paramNameToIndex) {
+              const re = new RegExp(`\\b${name2}\\b`);
+              if (re.test(arg.expression))
+                candidates.push(name2);
+            }
+          }
+          for (const cand of candidates) {
+            const idx = paramNameToIndex.get(cand);
+            if (idx !== undefined)
+              taintedParams.add(idx);
+          }
+        }
+      }
+    }
+    return [...taintedParams].sort((a, b) => a - b);
   }
   isSanitizerMethod(methodName) {
     const sanitizerPatterns = [
@@ -18309,12 +18452,24 @@ class CrossFileResolver {
       for (const source of ir.taint.sources) {
         if (source.type === "interprocedural_param")
           continue;
+        const sourceVar = source.variable ?? this.getLocalDefVarAt(ir, source.line);
         for (const call of ir.calls) {
           if (call.location.line < source.line)
             continue;
           const resolved = this.resolveCall(call, filePath);
           if (!resolved || resolved.targetFile === filePath)
             continue;
+          if (sourceVar) {
+            const argMentions = call.arguments.some((arg) => {
+              if (arg.variable === sourceVar)
+                return true;
+              if (arg.expression && new RegExp(`\\b${sourceVar}\\b`).test(arg.expression))
+                return true;
+              return false;
+            });
+            if (!argMentions)
+              continue;
+          }
           const targetIR = this.fileIRs.get(resolved.targetFile);
           if (!targetIR || targetIR.taint.sinks.length === 0)
             continue;
@@ -18353,6 +18508,407 @@ class CrossFileResolver {
     }
     return flows;
   }
+  findInterproceduralTaintPaths() {
+    const paths = [];
+    const seen = new Set;
+    const methodIndex = this.buildMethodIndex();
+    for (const [callerFile, callerIR] of this.fileIRs) {
+      for (const type of callerIR.types) {
+        for (const method of type.methods) {
+          const tainted = new Map;
+          for (const src of callerIR.taint.sources) {
+            if (src.type === "interprocedural_param")
+              continue;
+            if (src.line < method.start_line || src.line > method.end_line)
+              continue;
+            if (!src.variable)
+              continue;
+            tainted.set(src.variable, {
+              file: callerFile,
+              line: src.line,
+              type: src.type,
+              hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }]
+            });
+          }
+          const callsInMethod = callerIR.calls.filter((c) => c.location.line >= method.start_line && c.location.line <= method.end_line).sort((a, b) => a.location.line - b.location.line);
+          for (const call of callsInMethod) {
+            const resolved = this.resolveCall(call, callerFile);
+            if (!resolved)
+              continue;
+            const callee = this.methodTaintInfo.get(resolved.targetMethod);
+            if (!callee)
+              continue;
+            if (callee.returnsSource && !callee.sanitizes && callee.sourceType) {
+              const calleeNode = methodIndex.get(resolved.targetMethod);
+              const calleeSourceLine = calleeNode ? this.findRealSourceLineInMethod(calleeNode.ir, calleeNode.method) : undefined;
+              const sourceLine = calleeSourceLine ?? call.location.line;
+              const sourceFile = callee.file;
+              const sourceType = callee.sourceType;
+              const defsAtLine = callerIR.dfg.defs.filter((d) => d.line === call.location.line && d.kind === "local");
+              for (const def of defsAtLine) {
+                if (!def.variable)
+                  continue;
+                const baseChain = [
+                  { file: sourceFile, line: sourceLine, method: resolved.targetMethod, kind: "source" },
+                  { file: callerFile, line: call.location.line, method: method.name, kind: "wrapper_return" }
+                ];
+                tainted.set(def.variable, {
+                  file: sourceFile,
+                  line: sourceLine,
+                  type: sourceType,
+                  hopChain: baseChain
+                });
+              }
+            }
+            if (callee.taintedParams.length === 0 || callee.sanitizes)
+              continue;
+            for (let argIdx = 0;argIdx < call.arguments.length; argIdx++) {
+              if (!callee.taintedParams.includes(argIdx))
+                continue;
+              const arg = call.arguments[argIdx];
+              const matched = this.matchTaintedArg(arg, tainted);
+              if (!matched)
+                continue;
+              const calleeNode = methodIndex.get(resolved.targetMethod);
+              if (!calleeNode)
+                continue;
+              const sinksInCallee = calleeNode.ir.taint.sinks.filter((s) => s.line >= calleeNode.method.start_line && s.line <= calleeNode.method.end_line);
+              for (const sink of sinksInCallee) {
+                const key = `${matched.origin.file}:${matched.origin.line}→${callee.file}:${sink.line}`;
+                if (seen.has(key))
+                  continue;
+                seen.add(key);
+                const hops = [
+                  ...matched.origin.hopChain,
+                  { file: callerFile, line: call.location.line, method: method.name, kind: "sink_call" },
+                  { file: callee.file, line: sink.line, method: resolved.targetMethod, kind: "sink" }
+                ];
+                const decay = Math.max(0.3, Math.pow(0.85, Math.max(hops.length - 1, 0)));
+                paths.push({
+                  source: {
+                    file: matched.origin.file,
+                    line: matched.origin.line,
+                    type: matched.origin.type
+                  },
+                  sink: {
+                    file: callee.file,
+                    line: sink.line,
+                    type: sink.type,
+                    cwe: sink.cwe
+                  },
+                  hops,
+                  confidence: decay
+                });
+              }
+            }
+          }
+          if (tainted.size > 0) {
+            const sinksInCaller = callerIR.taint.sinks.filter((s) => s.line >= method.start_line && s.line <= method.end_line);
+            for (const sink of sinksInCaller) {
+              const callsAtSink = callerIR.calls.filter((c) => c.location.line === sink.line);
+              for (const sinkCall of callsAtSink) {
+                for (const arg of sinkCall.arguments ?? []) {
+                  const matched = this.matchTaintedArg(arg, tainted);
+                  if (!matched)
+                    continue;
+                  const key = `${matched.origin.file}:${matched.origin.line}→${callerFile}:${sink.line}`;
+                  if (seen.has(key))
+                    continue;
+                  seen.add(key);
+                  const hops = [
+                    ...matched.origin.hopChain,
+                    { file: callerFile, line: sink.line, method: method.name, kind: "sink" }
+                  ];
+                  const decay = Math.max(0.3, Math.pow(0.85, Math.max(hops.length - 1, 0)));
+                  paths.push({
+                    source: {
+                      file: matched.origin.file,
+                      line: matched.origin.line,
+                      type: matched.origin.type
+                    },
+                    sink: {
+                      file: callerFile,
+                      line: sink.line,
+                      type: sink.type,
+                      cwe: sink.cwe
+                    },
+                    hops,
+                    confidence: decay
+                  });
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+    return paths;
+  }
+  findFieldBindingTaintPaths() {
+    const paths = [];
+    const seen = new Set;
+    if (this.fieldTaintInfo.size === 0)
+      return paths;
+    const fieldExprRe = /^(\w+)\.(\w+)$/;
+    const methodIndex = this.buildMethodIndex();
+    for (const [callerFile, callerIR] of this.fileIRs) {
+      for (const type of callerIR.types) {
+        const callerTypeFqn = callerIR.meta.package ? `${callerIR.meta.package}.${type.name}` : type.name;
+        for (const method of type.methods) {
+          const tainted = new Map;
+          for (const src of callerIR.taint.sources) {
+            if (src.type === "interprocedural_param")
+              continue;
+            if (src.line < method.start_line || src.line > method.end_line)
+              continue;
+            if (!src.variable)
+              continue;
+            tainted.set(src.variable, {
+              file: callerFile,
+              line: src.line,
+              type: src.type,
+              hopChain: [{ file: callerFile, line: src.line, method: method.name, kind: "source" }]
+            });
+          }
+          const defsInMethod = callerIR.dfg.defs.filter((d) => d.kind === "local" && d.line >= method.start_line && d.line <= method.end_line && !!d.variable);
+          for (const def of defsInMethod) {
+            const usesAtLine = callerIR.dfg.uses.filter((u) => u.line === def.line);
+            if (usesAtLine.length < 2)
+              continue;
+            let receiver = null;
+            let fieldName = null;
+            if (def.expression) {
+              const exprMatch = fieldExprRe.exec(def.expression.trim());
+              if (exprMatch) {
+                receiver = exprMatch[1];
+                fieldName = exprMatch[2];
+              }
+            }
+            const resolveReceiverType = (rcv) => {
+              const param = method.parameters.find((p) => p.name === rcv);
+              if (param?.type)
+                return param.type;
+              const fieldOnSelf = type.fields?.find((f) => f.name === rcv);
+              if (fieldOnSelf?.type)
+                return fieldOnSelf.type;
+              return null;
+            };
+            let receiverType = null;
+            if (receiver && fieldName) {
+              receiverType = resolveReceiverType(receiver);
+            }
+            if (!receiverType) {
+              for (const rcvUse of usesAtLine) {
+                if (!rcvUse.variable || rcvUse.variable === def.variable)
+                  continue;
+                const rt = resolveReceiverType(rcvUse.variable);
+                if (!rt)
+                  continue;
+                const fieldUse = usesAtLine.find((u) => u !== rcvUse && !!u.variable && u.variable !== def.variable && u.variable !== rcvUse.variable && this.typeHasField(rt, u.variable));
+                if (fieldUse) {
+                  receiver = rcvUse.variable;
+                  fieldName = fieldUse.variable;
+                  receiverType = rt;
+                  break;
+                }
+              }
+            }
+            if (!receiver || !fieldName || !receiverType)
+              continue;
+            const fieldKey = this.resolveFieldTaintKey(receiverType, fieldName, callerIR);
+            if (!fieldKey)
+              continue;
+            const fieldInfo = this.fieldTaintInfo.get(fieldKey);
+            if (!fieldInfo || fieldInfo.writers.length === 0)
+              continue;
+            const writer = fieldInfo.writers.find((w) => w.sourceType === "constructor_field" || w.sourceType === "autowired_field") ?? null;
+            if (!writer)
+              continue;
+            const hopChain = [
+              {
+                file: fieldInfo.file,
+                line: writer.sourceLine,
+                method: writer.methodName,
+                kind: "source"
+              },
+              {
+                file: fieldInfo.file,
+                line: writer.writeLine,
+                method: writer.methodName,
+                kind: "field_write"
+              },
+              {
+                file: callerFile,
+                line: def.line,
+                method: method.name,
+                kind: "field_read"
+              }
+            ];
+            tainted.set(def.variable, {
+              file: fieldInfo.file,
+              line: writer.sourceLine,
+              type: writer.sourceType,
+              hopChain
+            });
+          }
+          if (tainted.size === 0)
+            continue;
+          const sinksInCaller = callerIR.taint.sinks.filter((s) => s.line >= method.start_line && s.line <= method.end_line);
+          for (const sink of sinksInCaller) {
+            const callsAtSink = callerIR.calls.filter((c) => c.location.line === sink.line);
+            for (const sinkCall of callsAtSink) {
+              for (const arg of sinkCall.arguments ?? []) {
+                const matched = this.matchTaintedArg(arg, tainted);
+                if (!matched)
+                  continue;
+                const key = `fb:${matched.origin.file}:${matched.origin.line}→${callerFile}:${sink.line}`;
+                if (seen.has(key))
+                  continue;
+                seen.add(key);
+                const hops = [
+                  ...matched.origin.hopChain,
+                  { file: callerFile, line: sink.line, method: method.name, kind: "sink" }
+                ];
+                const decay = Math.max(0.3, Math.pow(0.85, Math.max(hops.length - 1, 0)));
+                paths.push({
+                  source: {
+                    file: matched.origin.file,
+                    line: matched.origin.line,
+                    type: matched.origin.type
+                  },
+                  sink: {
+                    file: callerFile,
+                    line: sink.line,
+                    type: sink.type,
+                    cwe: sink.cwe
+                  },
+                  hops,
+                  confidence: decay
+                });
+              }
+            }
+          }
+          const callsInMethod = callerIR.calls.filter((c) => c.location.line >= method.start_line && c.location.line <= method.end_line).sort((a, b) => a.location.line - b.location.line);
+          for (const call of callsInMethod) {
+            const resolved = this.resolveCall(call, callerFile);
+            if (!resolved)
+              continue;
+            const callee = this.methodTaintInfo.get(resolved.targetMethod);
+            if (!callee || callee.sanitizes || callee.taintedParams.length === 0)
+              continue;
+            for (let argIdx = 0;argIdx < call.arguments.length; argIdx++) {
+              if (!callee.taintedParams.includes(argIdx))
+                continue;
+              const matched = this.matchTaintedArg(call.arguments[argIdx], tainted);
+              if (!matched)
+                continue;
+              const calleeNode = methodIndex.get(resolved.targetMethod);
+              if (!calleeNode)
+                continue;
+              const sinksInCallee = calleeNode.ir.taint.sinks.filter((s) => s.line >= calleeNode.method.start_line && s.line <= calleeNode.method.end_line);
+              for (const sink of sinksInCallee) {
+                const key = `fb:${matched.origin.file}:${matched.origin.line}→${callee.file}:${sink.line}`;
+                if (seen.has(key))
+                  continue;
+                seen.add(key);
+                const hops = [
+                  ...matched.origin.hopChain,
+                  { file: callerFile, line: call.location.line, method: method.name, kind: "sink_call" },
+                  { file: callee.file, line: sink.line, method: resolved.targetMethod, kind: "sink" }
+                ];
+                const decay = Math.max(0.3, Math.pow(0.85, Math.max(hops.length - 1, 0)));
+                paths.push({
+                  source: {
+                    file: matched.origin.file,
+                    line: matched.origin.line,
+                    type: matched.origin.type
+                  },
+                  sink: {
+                    file: callee.file,
+                    line: sink.line,
+                    type: sink.type,
+                    cwe: sink.cwe
+                  },
+                  hops,
+                  confidence: decay
+                });
+              }
+            }
+          }
+        }
+      }
+    }
+    return paths;
+  }
+  typeHasField(typeName, fieldName) {
+    for (const [, ir] of this.fileIRs) {
+      for (const t of ir.types) {
+        if (t.name !== typeName)
+          continue;
+        if ((t.fields ?? []).some((f) => f.name === fieldName))
+          return true;
+      }
+    }
+    return false;
+  }
+  resolveFieldTaintKey(receiverType, fieldName, _callerIR) {
+    const direct = `${receiverType}.${fieldName}`;
+    if (this.fieldTaintInfo.has(direct))
+      return direct;
+    const suffix = `.${receiverType}.${fieldName}`;
+    for (const key of this.fieldTaintInfo.keys()) {
+      if (key === direct)
+        return key;
+      if (key.endsWith(suffix))
+        return key;
+    }
+    return;
+  }
+  matchTaintedArg(arg, tainted) {
+    if (tainted.size === 0)
+      return null;
+    if (arg.variable && tainted.has(arg.variable)) {
+      return { var: arg.variable, origin: tainted.get(arg.variable) };
+    }
+    if (arg.expression) {
+      for (const [tv, origin] of tainted) {
+        const re = new RegExp(`\\b${tv}\\b`);
+        if (re.test(arg.expression))
+          return { var: tv, origin };
+      }
+    }
+    return null;
+  }
+  buildMethodIndex() {
+    const idx = new Map;
+    for (const [, ir] of this.fileIRs) {
+      const pkg = ir.meta.package || "";
+      for (const type of ir.types) {
+        const typeFqn = pkg ? `${pkg}.${type.name}` : type.name;
+        for (const method of type.methods) {
+          idx.set(`${typeFqn}.${method.name}`, { ir, method });
+        }
+      }
+    }
+    return idx;
+  }
+  getLocalDefVarAt(ir, line) {
+    for (const def of ir.dfg.defs) {
+      if (def.line === line && def.kind === "local" && def.variable)
+        return def.variable;
+    }
+    return;
+  }
+  findRealSourceLineInMethod(ir, method) {
+    for (const src of ir.taint.sources) {
+      if (src.type === "interprocedural_param")
+        continue;
+      if (src.line >= method.start_line && src.line <= method.end_line) {
+        return src.line;
+      }
+    }
+    return;
+  }
   getMethodTaintInfo(methodFqn) {
     return this.methodTaintInfo.get(methodFqn);
   }
@@ -18392,8 +18948,12 @@ class CrossFileResolver {
   clear() {
     this.fileIRs.clear();
     this.methodTaintInfo.clear();
+    this.fieldTaintInfo.clear();
     this.resolvedCalls.clear();
   }
+  getFieldTaintInfo(typeFqn, fieldName) {
+    return this.fieldTaintInfo.get(`${typeFqn}.${fieldName}`);
+  }
 }
 // ../circle-ir/dist/graph/project-graph.js
 class ProjectGraph {
@@ -18535,12 +19095,59 @@ class CrossFilePass {
         confidence: 0.7
       }];
     });
+    const ipPaths = [
+      ...resolver.findInterproceduralTaintPaths(),
+      ...resolver.findFieldBindingTaintPaths()
+    ];
+    for (let i2 = 0;i2 < ipPaths.length; i2++) {
+      const p = ipPaths[i2];
+      const sinkIR = projectGraph.getIR(p.sink.file);
+      if (!sinkIR)
+        continue;
+      const matchedSink = sinkIR.taint.sinks.find((s) => s.line === p.sink.line);
+      if (!matchedSink)
+        continue;
+      const srcLines = sourceLines.get(p.source.file) ?? [];
+      const tgtLines = sourceLines.get(p.sink.file) ?? [];
+      const dupId = `${p.source.file}:${p.source.line}→${p.sink.file}:${p.sink.line}`;
+      if (taintPaths.some((tp) => tp.source.file === p.source.file && tp.source.line === p.source.line && tp.sink.file === p.sink.file && tp.sink.line === p.sink.line)) {
+        continue;
+      }
+      taintPaths.push({
+        id: `cf-ip-${i2}-${dupId}`,
+        source: {
+          file: p.source.file,
+          line: p.source.line,
+          type: p.source.type,
+          code: srcLines[p.source.line - 1] ?? ""
+        },
+        sink: {
+          file: p.sink.file,
+          line: p.sink.line,
+          type: matchedSink.type,
+          cwe: matchedSink.cwe,
+          code: tgtLines[p.sink.line - 1] ?? ""
+        },
+        hops: p.hops.map((h) => ({
+          file: h.file,
+          method: h.method,
+          line: h.line,
+          code: (sourceLines.get(h.file) ?? [])[h.line - 1] ?? "",
+          variable: ""
+        })),
+        sanitizers_in_path: [],
+        path_exists: true,
+        confidence: p.confidence
+      });
+    }
     const crossFileCalls = [];
     for (const filePath of projectGraph.filePaths) {
       const resolved = resolver.getResolvedCallsFromFile(filePath);
       for (const rc of resolved) {
         if (rc.sourceFile === rc.targetFile)
           continue;
+        const calleeInfo = resolver.getMethodTaintInfo(rc.targetMethod);
+        const taintedParamSet = new Set(calleeInfo?.taintedParams ?? []);
         crossFileCalls.push({
           id: `${rc.sourceFile}:${rc.call.location.line}:${rc.targetMethod}`,
           from: {
@@ -18556,7 +19163,7 @@ class CrossFilePass {
           args_mapping: (rc.call.arguments ?? []).map((_, i2) => ({
             caller_arg: i2,
             callee_param: i2,
-            taint_propagates: false
+            taint_propagates: taintedParamSet.has(i2)
           })),
           resolved: rc.resolution === "exact"
         });
@@ -26983,7 +27590,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "3.37.0";
+var version = "3.39.0";
 
 // src/formatters.ts
 var SINK_SEVERITY = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "3.37.0",
+  "version": "3.39.0",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,7 +65,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "circle-ir": "^3.37.0"
+    "circle-ir": "^3.39.0"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",