hullproof 0.0.0-stage → 0.5.0

package/dist/map/rust.js

@@ -0,0 +1,312 @@
+import { empty, joinPath, makeEntry } from './entry.js';
+import { closeOf, splitArgs } from './lex.js';
+// ---- Cargo.toml ----------------------------------------------------------------------------------------------------------------------
+export function readCargo(file, text, hasLock, binary) {
+    const lines = text.split('\n');
+    const m = { file, line: 1, name: null, edition: null, dependencies: [], release_debug: null, release_overflow_checks: null, unsafe_code_lint: null, has_lock: hasLock, binary };
+    let section = '';
+    let pending = null;
+    const addDep = (name, body, line) => {
+        const t = body.trim();
+        let source = 'registry';
+        let version = null;
+        if (t.startsWith('{')) {
+            if (/\bgit\s*=/.test(t))
+                source = 'git';
+            else if (/\bpath\s*=/.test(t))
+                source = 'path';
+            version = /\bversion\s*=\s*"([^"]*)"/.exec(t)?.[1] ?? null;
+        }
+        else
+            version = /^"([^"]*)"/.exec(t)?.[1] ?? null;
+        m.dependencies.push({ name, source, version, line });
+    };
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i].replace(/(^|\s)#.*$/, '').trimEnd();
+        const line = i + 1;
+        if (pending) {
+            pending.text += ' ' + raw.trim();
+            pending.depth += (raw.match(/\{/g) ?? []).length - (raw.match(/\}/g) ?? []).length;
+            if (pending.depth <= 0) {
+                addDep(pending.name, pending.text, pending.line);
+                pending = null;
+            }
+            continue;
+        }
+        const sec = /^\s*\[\[?([^\]]+)\]\]?\s*$/.exec(raw);
+        if (sec) {
+            section = sec[1].trim();
+            const named = /^(?:workspace\.|target\.[^.]+\.)?(?:dependencies|build-dependencies)\.(.+)$/.exec(section);
+            if (named)
+                m.dependencies.push({ name: named[1], source: 'registry', version: null, line });
+            continue;
+        }
+        const kv = /^\s*([A-Za-z0-9_.-]+)\s*=\s*(.*)$/.exec(raw);
+        if (!kv)
+            continue;
+        if (section === 'package') {
+            if (kv[1] === 'name')
+                m.name = /"([^"]*)"/.exec(kv[2])?.[1] ?? null;
+            if (kv[1] === 'edition')
+                m.edition = /"([^"]*)"/.exec(kv[2])?.[1] ?? null;
+            if (kv[1] === 'name')
+                m.line = line;
+        }
+        else if (/^(?:workspace\.|target\.[^.]+\.)?(?:dependencies|build-dependencies)$/.test(section)) {
+            const depth = (kv[2].match(/\{/g) ?? []).length - (kv[2].match(/\}/g) ?? []).length;
+            if (depth > 0)
+                pending = { name: kv[1], line, text: kv[2], depth };
+            else
+                addDep(kv[1], kv[2], line);
+        }
+        else if (/^dependencies\./.test(section) || /^(?:workspace\.|target\.[^.]+\.)?(?:dependencies|build-dependencies)\.[^.]+$/.test(section)) {
+            const dep = m.dependencies[m.dependencies.length - 1];
+            if (dep && kv[1] === 'git')
+                dep.source = 'git';
+            else if (dep && kv[1] === 'path' && dep.source === 'registry')
+                dep.source = 'path';
+            else if (dep && kv[1] === 'version')
+                dep.version = /"([^"]*)"/.exec(kv[2])?.[1] ?? null;
+        }
+        else if (section === 'profile.release') {
+            if (kv[1] === 'debug')
+                m.release_debug = /^(true|2|1|"full"|"limited")/.test(kv[2].trim()) ? true : /^(false|0)/.test(kv[2].trim()) ? false : null;
+            if (kv[1] === 'overflow-checks')
+                m.release_overflow_checks = /^true/.test(kv[2].trim()) ? true : /^false/.test(kv[2].trim()) ? false : null;
+        }
+        else if (section === 'lints.rust' || section === 'workspace.lints.rust') {
+            if (kv[1] === 'unsafe_code')
+                m.unsafe_code_lint = /"([^"]*)"/.exec(kv[2])?.[1] ?? /level\s*=\s*"([^"]*)"/.exec(kv[2])?.[1] ?? null;
+        }
+    }
+    m.dependencies.sort((a, b) => a.line - b.line || (a.name < b.name ? -1 : 1));
+    return m;
+}
+export function cargoConfig(repo) {
+    const manifests = repo.ctx.files.filter((f) => /(?:^|\/)Cargo\.toml$/.test(f) && !/(?:^|\/)(?:target|node_modules|vendor)\//.test(f));
+    if (!manifests.length)
+        return null;
+    const set = new Set(repo.ctx.files);
+    return {
+        manifests: manifests.map((f) => {
+            const dir = f.includes('/') ? f.slice(0, f.lastIndexOf('/')) : '';
+            const up = (name) => { for (let d = dir;; d = d.includes('/') ? d.slice(0, d.lastIndexOf('/')) : '') {
+                if (set.has(d ? `${d}/${name}` : name))
+                    return true;
+                if (!d)
+                    return false;
+            } };
+            const text = repo.ctx.text(f);
+            const binary = set.has(dir ? `${dir}/src/main.rs` : 'src/main.rs') || /^\s*\[\[bin\]\]/m.test(text);
+            return readCargo(f, text, up('Cargo.lock'), binary);
+        }),
+    };
+}
+const AUTH_TYPE = /\b(?:AuthUser|CurrentUser|AuthenticatedUser|Authenticated|SessionUser|LoggedIn|UserClaims|Claims|Identity|BearerAuth|AuthBearer|Jwt|JwtClaims|Principal)\b|TypedHeader\s*<\s*Authorization|\bBearerAuth\b|\bUser\s*\(/;
+const ADMIN_TYPE = /\b(?:AdminUser|Admin|RequireAdmin|StaffUser|SuperUser|OwnerUser)\b/;
+const AUTH_NAME = /auth|login|session|jwt|token|bearer|identity|credential/i;
+const ROLE_NAME = /admin|role|permission|staff|owner|authorize|superuser/i;
+const SIGNATURE = /\b(?:verify_signature|verify_webhook|verify_slice|constant_time_eq|Webhook::construct_event|construct_event|validate_signature|verify_hmac|hmac_sha256_verify)\b|\bHmac\s*::\s*<|\bMac\s*::\s*verify/;
+const RATE = /\bGovernorLayer\b|\bRateLimitLayer\b|\btower_governor\b|\bRateLimiter\b/;
+function fnDefs(repo) {
+    const out = new Map();
+    for (const f of repo.filesOf('rs')) {
+        const v = repo.view(f);
+        if (!v)
+            continue;
+        const m = v.masked;
+        for (const x of m.matchAll(/(?:^|\n)[ \t]*(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?(?:unsafe\s+)?fn\s+(\w+)\s*(?:<[^>\n]*>)?\s*\(/g)) {
+            const open = x.index + x[0].length - 1;
+            const pc = closeOf(m, open);
+            if (pc < 0)
+                continue;
+            let j = pc;
+            while (j < m.length && m[j] !== '{' && m[j] !== ';')
+                j++;
+            if (m[j] !== '{')
+                continue;
+            const e = closeOf(m, j);
+            if (e < 0)
+                continue;
+            const def = { view: v, name: x[1], start: x.index + x[0].indexOf('fn'), end: e, paramsText: v.text.slice(open + 1, pc - 1), bodyStart: j };
+            out.set(x[1], [...(out.get(x[1]) ?? []), def]);
+        }
+    }
+    return out;
+}
+// What a layer or middleware function says, from its name and, when the function is in the project, what its body answers.
+function layerProtections(defs, view, at, expr) {
+    const out = [];
+    const names = [...expr.matchAll(/\b(?:from_fn(?:_with_state)?|map_request|from_extractor|from_extractor_with_state)\s*(?:::\s*<[^>]*>)?\s*\(\s*(?:[^,()]*,\s*)?([A-Za-z_][\w:]*)/g)].map((x) => x[1].split('::').pop());
+    const consts = [...expr.matchAll(/\b(\w*(?:Auth|Bearer|Jwt|Session)\w*Layer)\b/g)].map((x) => x[1]);
+    const line = view.lines.at(at);
+    const push = (kind, via, enforced, confidence) => { out.push({ kind, scope: 'middleware', file: view.file, line, via, enforced, confidence }); };
+    for (const n of [...names, ...consts]) {
+        const d = defs.get(n)?.[0];
+        const body = d ? d.view.text.slice(d.bodyStart, d.end) : '';
+        const rejects = /StatusCode::(?:UNAUTHORIZED|FORBIDDEN)|Err\s*\(/.test(body);
+        if (ROLE_NAME.test(n)) {
+            push('role_check', `layer ${n}`, d ? (rejects ? true : null) : null, d && rejects ? 'high' : 'medium');
+            if (AUTH_NAME.test(n))
+                push('session_read', `layer ${n}`, d ? (rejects ? true : null) : null, d && rejects ? 'high' : 'medium');
+        }
+        else if (AUTH_NAME.test(n))
+            push('session_read', `layer ${n}`, d ? (rejects ? true : null) : null, d && rejects ? 'high' : 'medium');
+    }
+    if (RATE.test(expr))
+        push('rate_limit', 'rate limit layer', null, 'medium');
+    return out;
+}
+const handlerProtections = (d, name) => {
+    if (!d)
+        return [];
+    const out = [];
+    const line = d.view.lines.at(d.start);
+    const p = d.paramsText;
+    if (ADMIN_TYPE.test(p)) {
+        out.push({ kind: 'role_check', scope: 'handler', file: d.view.file, line, via: `extractor ${ADMIN_TYPE.exec(p)[0]}`, enforced: true, confidence: 'medium' });
+        out.push({ kind: 'session_read', scope: 'handler', file: d.view.file, line, via: `extractor ${ADMIN_TYPE.exec(p)[0]}`, enforced: true, confidence: 'medium' });
+    }
+    else if (AUTH_TYPE.test(p))
+        out.push({ kind: 'session_read', scope: 'handler', file: d.view.file, line, via: `extractor ${AUTH_TYPE.exec(p)[0].trim()}`, enforced: true, confidence: 'medium' });
+    const body = d.view.text.slice(d.bodyStart, d.end);
+    if (SIGNATURE.test(body))
+        out.push({ kind: 'signature_verify', scope: 'handler', file: d.view.file, line: d.view.lines.at(d.bodyStart + (SIGNATURE.exec(body)?.index ?? 0)), via: SIGNATURE.exec(body)[0], enforced: /if\s+!|return\s+(?:Err|StatusCode::UNAUTHORIZED)|\?;/.test(body) ? true : null, confidence: 'high' });
+    void name;
+    return out;
+};
+function chainAt(v, from) {
+    const m = v.masked;
+    const calls = [];
+    let i = from + 'Router::new()'.length;
+    for (;;) {
+        const mm = /^\s*\.\s*(\w+)\s*(?:::\s*<[^>]*>)?\s*\(/.exec(m.slice(i, i + 400));
+        if (!mm)
+            break;
+        const open = i + mm[0].length - 1;
+        const close = closeOf(m, open);
+        if (close < 0)
+            break;
+        calls.push({ name: mm[1], open, close });
+        i = close;
+    }
+    return { view: v, calls };
+}
+export function rustFiles(repo) {
+    return repo.filesOf('rs').filter((f) => { const v = repo.view(f); return !!v && (/\bRouter\s*::\s*new\s*\(/.test(v.masked) || /#\s*\[\s*(?:get|post|put|delete|patch)\s*\(/.test(v.text)); });
+}
+export function extractRust(repo) {
+    const out = empty();
+    const defs = fnDefs(repo);
+    const METHODS = new Set(['get', 'post', 'put', 'delete', 'patch', 'head', 'options', 'any']);
+    const handlerOf = (expr) => {
+        // get(h).post(h2).layer(...) : the handler of each method, and the text of layers placed on the method router
+        const res = [];
+        let layers = '';
+        for (const x of expr.matchAll(/(?:^|\.|\b)(get|post|put|delete|patch|head|options|any|on|layer|route_layer)\s*\(((?:[^()]|\((?:[^()]|\([^()]*\))*\))*)\)/g)) {
+            if (x[1] === 'layer' || x[1] === 'route_layer') {
+                layers += ' ' + x[2];
+                continue;
+            }
+            if (!METHODS.has(x[1]))
+                continue;
+            const nm = /([A-Za-z_][\w:]*)\s*$/.exec(x[2].trim().replace(/\)\s*$/, ''))?.[1]?.split('::').pop();
+            if (nm)
+                res.push({ method: x[1].toUpperCase(), name: nm, layers: '' });
+        }
+        return res.map((r) => ({ ...r, layers }));
+    };
+    const build = (ch, vars, depth) => {
+        let routes = [];
+        const v = ch.view;
+        for (const c of ch.calls) {
+            const args = splitArgs(v.masked, c.open);
+            const txt = (k) => (args[k] ? v.text.slice(args[k].start, args[k].end) : '');
+            if (c.name === 'route' && args.length >= 2) {
+                const path = /"([^"]*)"/.exec(txt(0))?.[1];
+                if (path === undefined)
+                    continue;
+                for (const h of handlerOf(txt(1)))
+                    routes.push({ method: h.method, path, handler: h.name, view: v, at: c.open, prot: h.layers ? layerProtections(defs, v, c.open, h.layers) : [] });
+            }
+            else if ((c.name === 'nest' || c.name === 'merge') && depth < 6) {
+                const prefix = c.name === 'nest' ? /"([^"]*)"/.exec(txt(0))?.[1] ?? '' : '';
+                const target = c.name === 'nest' ? txt(1).trim() : txt(0).trim();
+                let sub = null;
+                const inl = /Router\s*::\s*new\s*\(\s*\)/.exec(target);
+                if (inl) {
+                    const start = args[c.name === 'nest' ? 1 : 0].start + inl.index;
+                    sub = chainAt(v, start);
+                }
+                else if (/^\w+$/.test(target))
+                    sub = vars.get(target) ?? null;
+                if (!sub)
+                    continue;
+                for (const r of build(sub, vars, depth + 1))
+                    routes.push({ ...r, path: prefix ? joinPath(prefix, r.path) : r.path });
+            }
+            else if (c.name === 'layer' || c.name === 'route_layer') {
+                const ps = layerProtections(defs, v, c.open, txt(0));
+                if (ps.length)
+                    routes = routes.map((r) => ({ ...r, prot: [...r.prot, ...ps] }));
+            }
+        }
+        return routes;
+    };
+    for (const file of rustFiles(repo)) {
+        const v = repo.view(file);
+        if (!v)
+            continue;
+        const m = v.masked;
+        // axum: chains, with `let name = Router::new()...;` variables resolved by name within the file
+        const vars = new Map();
+        const chains = [];
+        for (const x of m.matchAll(/\bRouter\s*::\s*new\s*\(\s*\)/g)) {
+            const before = m.slice(Math.max(0, x.index - 120), x.index);
+            const prevCall = /\.\s*(?:nest|merge)\s*\(\s*(?:"[^"]*"\s*,\s*)?$/.test(before);
+            if (prevCall)
+                continue;
+            const nm = /\blet\s+(?:mut\s+)?(\w+)(?:\s*:\s*[\w<>:, ]+)?\s*=\s*$/.exec(before)?.[1] ?? null;
+            const ch = chainAt(v, x.index);
+            if (nm)
+                vars.set(nm, ch);
+            chains.push({ name: nm, chain: ch });
+        }
+        // Roots: chains that no other chain nests or merges by name.
+        const used = new Set();
+        for (const { chain } of chains)
+            for (const c of chain.calls)
+                if (c.name === 'nest' || c.name === 'merge') {
+                    const t = splitArgs(v.masked, c.open).map((a) => v.text.slice(a.start, a.end).trim());
+                    for (const a of t)
+                        if (/^\w+$/.test(a))
+                            used.add(a);
+                }
+        const seen = new Set();
+        for (const { name, chain } of chains) {
+            if (name && used.has(name))
+                continue;
+            for (const r of build(chain, vars, 0)) {
+                const key = `${r.method} ${r.path} ${r.handler} ${r.at}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const d = (defs.get(r.handler) ?? []).find((x) => x.view.file === file) ?? defs.get(r.handler)?.[0];
+                const prot = [...r.prot, ...handlerProtections(d, r.handler)];
+                const analysis = { protections: prot, reads: [], data: [], outbound: [], taint: { names: new Set(), validated: new Set(), trusted: new Set() } };
+                const hv = d?.view ?? v;
+                out.entries.push(makeEntry(repo, {
+                    kind: 'http_route', framework: 'axum', file, line: v.lines.at(r.at), method: r.method, path: r.path === '' ? '/' : joinPath('', r.path), name: r.handler,
+                    confidence: d ? 'high' : 'medium', handlerView: hv, spec: { start: d?.start ?? r.at, end: d?.end ?? r.at, seeds: [] }, analysis,
+                }));
+            }
+        }
+        // actix web: #[get("/x")] above an async fn
+        for (const x of v.text.matchAll(/#\s*\[\s*(get|post|put|delete|patch|head)\s*\(\s*"([^"]*)"[^\]]*\]\s*(?:\n\s*#\s*\[[^\]]*\]\s*)*\n?\s*(?:pub\s+)?(?:async\s+)?fn\s+(\w+)/g)) {
+            const d = (defs.get(x[3]) ?? []).find((y) => y.view.file === file);
+            const analysis = { protections: handlerProtections(d, x[3]), reads: [], data: [], outbound: [], taint: { names: new Set(), validated: new Set(), trusted: new Set() } };
+            out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'actix-web', file, line: v.lines.at(x.index), method: x[1].toUpperCase(), path: joinPath('', x[2]), name: x[3], confidence: 'medium', handlerView: v, spec: { start: d?.start ?? x.index, end: d?.end ?? x.index, seeds: [] }, analysis }));
+        }
+    }
+    return out;
+}

package/dist/map/spring.js

@@ -0,0 +1,207 @@
+import { annotationBlocks, splitTop, strings } from './cblocks.js';
+import { empty, joinPath, makeEntry, normPath } from './entry.js';
+import { cMethod } from './light-index.js';
+import { analyzeLight } from './light.js';
+import { closeOf } from './lex.js';
+const MAPPING_VERB = { GetMapping: 'GET', PostMapping: 'POST', PutMapping: 'PUT', DeleteMapping: 'DELETE', PatchMapping: 'PATCH' };
+const REQUEST_SEEDS = /@(?:PathVariable|RequestParam|RequestBody|RequestHeader|CookieValue|ModelAttribute|MatrixVariable|RequestPart)\b/;
+const SIMPLE_TYPES = /^(?:String|Long|Integer|int|long|UUID|Boolean|boolean|Double|double|LocalDate|BigDecimal)\b/;
+const METHOD_SECURITY = /@(?:PreAuthorize|PostAuthorize|Secured|RolesAllowed)\b/;
+export function springFiles(repo) {
+    return repo.filesOf('java').filter((f) => { const v = repo.view(f); return !!v && /@(?:Rest)?Controller\b/.test(v.masked); });
+}
+const EFFECT = [
+    [/^permitAll$|^anonymous$/, 'permit'], [/^authenticated$|^fullyAuthenticated$|^rememberMe$/, 'authenticated'],
+    [/^hasRole$|^hasAnyRole$|^hasAuthority$|^hasAnyAuthority$|^access$/, 'role'], [/^denyAll$/, 'deny'],
+];
+function securityInfo(repo) {
+    const info = { rules: [], chains: 0, methodSecurity: false, starter: false, securityMatchers: false };
+    for (const f of ['pom.xml', 'build.gradle', 'build.gradle.kts'])
+        if (/spring-boot-starter-security|spring-security-web|spring-security-config/.test(repo.ctx.text(f)))
+            info.starter = true;
+    for (const file of repo.filesOf('java')) {
+        const v = repo.view(file);
+        if (!v)
+            continue;
+        const m = v.masked;
+        if (/@EnableMethodSecurity\b|@EnableGlobalMethodSecurity\b/.test(m))
+            info.methodSecurity = true;
+        if (!/\bSecurityFilterChain\b|\bWebSecurityConfigurerAdapter\b|\bauthorizeHttpRequests\b|\bauthorizeRequests\b/.test(m))
+            continue;
+        if (/\bsecurityMatchers?\s*\(/.test(m))
+            info.securityMatchers = true;
+        for (const start of [...m.matchAll(/\.\s*(?:authorizeHttpRequests|authorizeRequests)\s*\(/g)]) {
+            info.chains++;
+            const open = start.index + start[0].length - 1;
+            const close = closeOf(m, open);
+            let end = close > 0 ? close : open;
+            // authorizeRequests() with no argument is followed by a chain that runs to the end of the statement
+            if (close > 0 && close === open + 2) {
+                const semi = m.indexOf(';', close);
+                end = semi < 0 ? m.length : semi;
+            }
+            const region = m.slice(open, end);
+            const text = v.text.slice(open, end);
+            for (const tok of region.matchAll(/\.\s*(requestMatchers|antMatchers|mvcMatchers|regexMatchers|anyRequest)\s*\(/g)) {
+                const any = tok[1] === 'anyRequest';
+                let a = tok.index + tok[0].length - 1;
+                let argsText = '';
+                if (!any) {
+                    const c = closeOf(region, a);
+                    if (c < 0)
+                        continue;
+                    argsText = text.slice(a + 1, c - 1);
+                    a = c;
+                }
+                else {
+                    const c = closeOf(region, a);
+                    a = c > 0 ? c : a + 1;
+                }
+                const eff = /^\s*\.\s*(permitAll|anonymous|authenticated|fullyAuthenticated|rememberMe|hasRole|hasAnyRole|hasAuthority|hasAnyAuthority|access|denyAll)\s*\(([^)]*)\)/.exec(region.slice(a));
+                if (!eff)
+                    continue;
+                const effect = EFFECT.find(([re]) => re.test(eff[1]))[1];
+                const lits = strings(argsText);
+                const methods = [...argsText.matchAll(/\bHttpMethod\s*\.\s*([A-Z]+)/g)].map((x) => x[1]);
+                const roles = strings(text.slice(a, a + eff[0].length)).map((r) => r.replace(/^ROLE_/, ''));
+                const line = v.lines.at(open + tok.index);
+                info.rules.push({ methods, patterns: lits, any, effect, roles, file, line, readable: any || lits.length > 0 });
+            }
+        }
+    }
+    return info;
+}
+// An Ant style pattern from the filter chain against a path of the map (parameters written :name).
+function antMatch(pattern, path) {
+    const re = pattern.replace(/[.+^$|\\()[\]]/g, '\\$&').replace(/\{[^/}]+\}/g, '[^/]+').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]').replace(/\u0000/g, '.*');
+    const p = path.replace(/:\w+/g, 'x');
+    return new RegExp(`^${re}$`).test(p) || (pattern.endsWith('/**') && p === pattern.slice(0, -3));
+}
+function params(text) {
+    const seeds = [];
+    let principal = false;
+    for (const part of splitTop(text)) {
+        const name = /(\w+)\s*$/.exec(part.replace(/\s*=\s*[^,]*$/, ''))?.[1];
+        if (!name)
+            continue;
+        if (/@AuthenticationPrincipal\b|\b(?:Principal|Authentication)\s+\w+$/.test(part)) {
+            principal = true;
+            continue;
+        }
+        const bare = part.replace(/@\w+(?:\([^)]*\))?\s*/g, '').trim();
+        if (REQUEST_SEEDS.test(part) || (!/@/.test(part) && SIMPLE_TYPES.test(bare)))
+            seeds.push(name);
+    }
+    return { seeds, principal };
+}
+const pathsOf = (a, text) => {
+    if (!a || !a.args)
+        return [''];
+    const args = text.slice(a.args.start, a.args.end);
+    const named = /\b(?:value|path)\s*=\s*(\{[^}]*\}|"(?:[^"\\]|\\.)*")/.exec(args);
+    const lits = named ? strings(named[1]) : /^\s*(\{[^}]*\}|"(?:[^"\\]|\\.)*")/.exec(args) ? strings(/^\s*(\{[^}]*\}|"(?:[^"\\]|\\.)*")/.exec(args)[1]) : [];
+    return lits.length ? lits : [''];
+};
+export function extractSpring(repo, fn, local) {
+    const out = empty();
+    const sec = securityInfo(repo);
+    const gates = sec.rules.map((r, i) => ({
+        id: `spring:${r.file}:${r.line}:${i}`, kind: 'guard', framework: 'spring', file: r.file, line: r.line,
+        paths: r.any ? ['*'] : r.patterns.map((p) => p.replace(/\/?\*\*?.*$/, '') || '/'), methods: r.methods,
+        protections: ruleProtections(r), confidence: sec.securityMatchers ? 'medium' : 'high',
+    }));
+    out.gates.push(...gates);
+    const fileOf = (v) => {
+        const m = v.masked;
+        for (const cls of annotationBlocks(m, 0, m.length)) {
+            const names = cls.annos.map((a) => a.name);
+            if (!names.some((n) => n === 'RestController' || n === 'Controller'))
+                continue;
+            const decl = /^(?:(?:public|abstract|final|static)\s+)*class\s+(\w+)[^{]*\{/.exec(m.slice(cls.declStart, cls.declStart + 400));
+            if (!decl)
+                continue;
+            const className = decl[1];
+            const bodyOpen = cls.declStart + decl[0].length - 1;
+            const bodyClose = closeOf(m, bodyOpen);
+            if (bodyClose < 0)
+                continue;
+            const classMap = cls.annos.find((a) => a.name === 'RequestMapping');
+            const prefix = pathsOf(classMap, v.text)[0];
+            const classDeco = { view: v, start: cls.start, end: cls.end, scope: 'router' };
+            for (const blk of annotationBlocks(m, bodyOpen + 1, bodyClose - 1)) {
+                const mappings = blk.annos.filter((a) => a.name === 'RequestMapping' || MAPPING_VERB[a.name]);
+                if (!mappings.length)
+                    continue;
+                const nameAt = /(\w+)\s*\(/.exec(m.slice(blk.declStart, blk.declStart + 300));
+                if (!nameAt)
+                    continue;
+                const at = blk.declStart + nameAt.index;
+                const f = cMethod(m, at);
+                if (!f)
+                    continue;
+                const pr = params(f.params);
+                const decos = [{ view: v, start: blk.start, end: blk.end, scope: 'wrapper' }];
+                if (cls.annos.some((a) => a !== classMap))
+                    decos.push(classDeco);
+                const methodAt = blk.declStart;
+                for (const a of mappings) {
+                    const verbs = MAPPING_VERB[a.name]
+                        ? [MAPPING_VERB[a.name]]
+                        : (() => { const mm = a.args ? /\bmethod\s*=\s*(\{[^}]*\}|[\w.]+)/.exec(v.text.slice(a.args.start, a.args.end)) : null; const vs = mm ? [...mm[1].matchAll(/\b([A-Z]{3,7})\b/g)].map((x) => x[1]).filter((x) => x !== 'RequestMethod') : []; return vs.length ? vs : ['ANY']; })();
+                    for (const p of pathsOf(a, v.text)) {
+                        const joined = joinPath(prefix, p) || '/';
+                        const full = joined.startsWith('/') ? joined : `/${joined}`;
+                        for (const verb of verbs) {
+                            const extra = globalProtections(sec, verb, full);
+                            const an = analyzeLight(v, { start: methodAt, end: f.end, seeds: pr.seeds, decorators: decos, extra, lookup: fn.find, local });
+                            if (!sec.methodSecurity)
+                                for (const q of an.protections)
+                                    if (METHOD_SECURITY.test(lineText(v, q.line))) {
+                                        q.enforced = false;
+                                        q.via += ' (method security is not enabled)';
+                                    }
+                            out.entries.push(makeEntry(repo, {
+                                kind: 'http_route', framework: 'spring', file: v.file, line: v.lines.at(mappings[0].start), method: verb, path: normPath(full), name: `${className}.${nameAt[1]}`,
+                                confidence: 'high', handlerView: v, spec: { start: methodAt, end: f.end, seeds: pr.seeds }, analysis: an,
+                            }));
+                        }
+                    }
+                }
+            }
+        }
+    };
+    for (const file of springFiles(repo)) {
+        const v = repo.view(file);
+        if (v)
+            fileOf(v);
+    }
+    return out;
+}
+const lineText = (v, line) => v.text.slice(v.lines.start(line), v.lines.start(line + 1));
+function ruleProtections(r) {
+    const base = { scope: 'global', file: r.file, line: r.line, enforced: true, confidence: 'high' };
+    if (r.effect === 'authenticated')
+        return [{ ...base, kind: 'session_read', via: 'authorizeHttpRequests authenticated' }];
+    if (r.effect === 'role')
+        return [{ ...base, kind: 'session_read', via: 'authorizeHttpRequests role rule' }, { ...base, kind: 'role_check', via: `authorizeHttpRequests ${r.roles.length ? 'role ' + r.roles.join(', ') : 'role rule'}` }];
+    if (r.effect === 'deny')
+        return [{ ...base, kind: 'session_read', via: 'authorizeHttpRequests denyAll' }, { ...base, kind: 'role_check', via: 'authorizeHttpRequests denyAll' }];
+    return [];
+}
+// What the filter chain says about one route: the first rule that matches decides. Without a chain, the security starter's default needs a
+// sign in for every request.
+function globalProtections(sec, method, path) {
+    const conf = sec.securityMatchers ? 'medium' : 'high';
+    for (const r of sec.rules) {
+        if (!r.readable)
+            continue;
+        if (r.methods.length && method !== 'ANY' && !r.methods.includes(method))
+            continue;
+        if (!r.any && !r.patterns.some((p) => antMatch(p, path)))
+            continue;
+        return ruleProtections(r).map((q) => ({ ...q, confidence: conf }));
+    }
+    if (!sec.chains && sec.starter)
+        return [{ kind: 'session_read', scope: 'global', file: 'pom.xml', line: 1, via: 'Spring Security default: every request needs a sign in', enforced: true, confidence: 'medium' }];
+    return [];
+}

package/dist/map/taint.js

@@ -0,0 +1,96 @@
+import { statementEnd } from './lex.js';
+import { SESSION_JS, SESSION_PY } from './vocab.js';
+const KEYWORDS = new Set(['const', 'let', 'var', 'await', 'async', 'new', 'return', 'typeof', 'if', 'else', 'null', 'undefined', 'true', 'false', 'None', 'True', 'False', 'not', 'and', 'or', 'in', 'is', 'lambda', 'for', 'while', 'self', 'cls']);
+// Identifiers in an expression that are values and not property names (not preceded by a dot).
+export function identifiers(expr) {
+    const out = [];
+    for (const m of expr.matchAll(/(?<![.\w$])([A-Za-z_$][\w$]*)/g))
+        if (!KEYWORDS.has(m[1]))
+            out.push(m[1]);
+    return out;
+}
+const SOURCE_JS = /\b(?:req|request|ctx|event)\s*[.\[]|\bsearchParams\b|\bformData\b|\bnextUrl\b|\bc\.req\b|\bawait\s+\w+\.(?:json|formData|text)\s*\(\)|\bURL\s*\(\s*(?:req|request)\.url/;
+const SOURCE_PY = /\brequest\s*[.\[]|\brequest\b\.|\bflask\.request\b|\binput\s*\(|\bsys\.argv\b/;
+// Values that come from the session and not from the request: req.user, current_user, session[...] and the like.
+export const TRUSTED_CHAIN = /\b(?:req|request|ctx|event)\s*\.\s*(?:user|session|auth|locals\s*\.\s*user|state\s*\.\s*user)\b|\bcurrent_user\b|\bg\.user\b|\bsession\s*[\[.]|\bc\.get\(\s*['"]user/g;
+// `seeds`: names that hold request data on entry. `validated` collects names assigned from a schema parse, which are
+// still request data but are shaped by a schema (so passing one whole into a create is not a free for all).
+export function taintOf(masked, original, seeds, lang, extraSession = []) {
+    const names = new Set(seeds);
+    const validated = new Set();
+    const trusted = new Set();
+    const isSource = lang === 'js' ? SOURCE_JS : SOURCE_PY;
+    const sessionPats = [...(lang === 'js' ? SESSION_JS : SESSION_PY), ...extraSession].filter((p) => p.confidence !== 'low');
+    const fromSession = (expr) => sessionPats.some((p) => { p.re.lastIndex = 0; return p.re.test(expr); });
+    const tainted = (expr) => { const e = expr.replace(TRUSTED_CHAIN, ' '); return isSource.test(e) || identifiers(e).some((i) => names.has(i) && !trusted.has(i)); };
+    const parsed = (expr) => /\.(?:safeParse|parse|parseAsync|safeParseAsync|model_validate|parse_obj|load|validate)\s*\(/.test(expr) || /\bvalidated|\.data\b/.test(expr) && identifiers(expr).some((i) => validated.has(i));
+    const assignments = [];
+    if (lang === 'js') {
+        for (const m of masked.matchAll(/\b(?:const|let|var)\s+(?:(\w+)|\{([^}]*(?:\{[^}]*\}[^}]*)*)\}|\[([^\]]*)\])\s*(?::[^=\n]+)?=(?!=)/g)) {
+            const rhsStart = m.index + m[0].length;
+            const rhsEnd = statementEnd(masked, rhsStart);
+            const lhs = m[1] ? [m[1]] : identifiers((m[2] ?? m[3] ?? '').replace(/(\w+)\s*:/g, ' ')).concat(identifiers((m[2] ?? '')));
+            assignments.push({ lhs, rhs: original.slice(rhsStart, rhsEnd) });
+        }
+        for (const m of masked.matchAll(/(?<![.\w$])([A-Za-z_$][\w$]*)\s*=(?![=>])/g)) {
+            const rhsStart = m.index + m[0].length;
+            assignments.push({ lhs: [m[1]], rhs: original.slice(rhsStart, statementEnd(masked, rhsStart)) });
+        }
+    }
+    else {
+        for (const m of masked.matchAll(/^[ \t]*([A-Za-z_][\w]*(?:\s*,\s*[A-Za-z_]\w*)*)\s*(?::[^=\n]+)?=(?!=)/gm)) {
+            const rhsStart = m.index + m[0].length;
+            assignments.push({ lhs: m[1].split(',').map((s) => s.trim()), rhs: original.slice(rhsStart, statementEnd(masked, rhsStart)) });
+        }
+        for (const m of masked.matchAll(/\bfor\s+([A-Za-z_]\w*)\s+in\s+([^\n:]+):/g))
+            assignments.push({ lhs: [m[1]], rhs: m[2] });
+    }
+    for (let pass = 0; pass < 4; pass++) {
+        let changed = false;
+        for (const a of assignments) {
+            if (fromSession(a.rhs)) {
+                for (const l of a.lhs)
+                    if (!trusted.has(l)) {
+                        trusted.add(l);
+                        names.delete(l);
+                        changed = true;
+                    }
+                continue;
+            }
+            if (!tainted(a.rhs))
+                continue;
+            const fromSchema = parsed(a.rhs);
+            for (const l of a.lhs) {
+                if (!names.has(l)) {
+                    names.add(l);
+                    changed = true;
+                }
+                if (fromSchema && !validated.has(l)) {
+                    validated.add(l);
+                    changed = true;
+                }
+            }
+        }
+        if (!changed)
+            break;
+    }
+    return { names, validated, trusted };
+}
+export const isTainted = (t, expr, lang) => {
+    const e = expr.replace(TRUSTED_CHAIN, ' ');
+    return (lang === 'js' ? SOURCE_JS : SOURCE_PY).test(e) || identifiers(e).some((i) => t.names.has(i) && !t.trusted.has(i));
+};
+// Whether a session derived value reaches this text: a trusted name, a chain such as req.user or current_user, or a field of
+// a context object that the framework hands in (ctx.userId, auth.uid, session.user.id).
+export const hasSessionValue = (t, expr) => {
+    TRUSTED_CHAIN.lastIndex = 0;
+    if (TRUSTED_CHAIN.test(expr) || identifiers(expr).some((i) => t.trusted.has(i)))
+        return true;
+    for (const m of expr.matchAll(/(?<![.\w$])([A-Za-z_$][\w$]*)((?:\s*\??\.\s*[\w$]+)+)/g)) {
+        if (t.names.has(m[1]) && !t.trusted.has(m[1]))
+            continue;
+        if (/^(?:ctx|context|auth|session|principal|identity|viewer|currentUser|me|actor|caller|user|usr|account|current)$/i.test(m[1]) && /user|id|uid|sub|account|tenant|org|owner/i.test(m[2]))
+            return true;
+    }
+    return false;
+};