projscan 4.5.0 → 4.7.0

package/dist/core/taint.js

@@ -1,4 +1,36 @@
-import { FRAMEWORK_REQUEST_SOURCES, frameworkRequestSourceForFunction, } from './frameworkSources.js';
+import { FRAMEWORK_REQUEST_SOURCES } from './frameworkSources.js';
+import { buildTaintFunctionIndex } from './taintIndex.js';
+import { findTaintFlows } from './taintTraversal.js';
+/**
+ * Lightweight taint flow analysis (1.6+).
+ *
+ * Source-to-sink reachability over the existing per-function call
+ * graph. Sources and sinks are *declared* by name (config-driven);
+ * anything in between is treated as a function that might propagate
+ * taint. We do NOT do general dataflow — we only ask "does some
+ * call chain reach from a function that calls a source to a function
+ * that calls a sink?"
+ *
+ * That heuristic catches the common case: a route handler reads
+ * `process.env.SECRET` (source) and somewhere downstream it ends up
+ * in `child_process.spawn` (sink). It misses any flow that goes
+ * through code we can't see (eval'd strings, plugin loaders), and it
+ * over-reports when functions read sources but launder them safely
+ * before reaching sinks. Both are documented limitations.
+ *
+ * Legacy taint algorithm gap (1.6+): the "bridge-helper" pattern is missed —
+ * `function bridge() { const v = getSecret(); runDangerous(v); }` where
+ * `getSecret` reads the source and `runDangerous` is the sink. The BFS
+ * walks DOWN from source-fns, but `bridge` has neither source nor sink
+ * directly; both are its callees. 3.0's `computeDataflow` /
+ * `projscan_dataflow` runs that second algorithm and review surfaces it
+ * as `newDataflowRisks`. Keep this legacy function as the compatibility
+ * source-to-sink reachability report.
+ *
+ * Strict scope discipline (per ROADMAP 1.6 guardrail): no CFG, no
+ * variable-level dataflow, no AST inspection beyond what callSites
+ * already gives us. If this drifts toward "general dataflow" cut it.
+ */
 export const DEFAULT_TAINT_SOURCES = [
     'env', // process.env.X
     'argv', // process.argv
@@ -33,45 +65,6 @@ export const DEFAULT_TAINT_SINKS = [
     'innerHTML', // DOM XSS — actually a property assignment, not a call;
     //             included only when call-shaped helpers wrap it (e.g. setInnerHtml).
 ];
-const JAVASCRIPT_CHILD_PROCESS_SINKS = new Set(['exec', 'execSync', 'spawn', 'spawnSync']);
-const DEFAULT_DATABASE_SINKS = new Set(['query', 'execute', '$queryRaw', '$executeRaw', 'raw']);
-const DATABASE_RECEIVERS = new Set([
-    'db',
-    'database',
-    'pool',
-    'client',
-    'connection',
-    'conn',
-    'prisma',
-    'knex',
-    'sequelize',
-    'repository',
-    'repo',
-    'manager',
-    'sql',
-]);
-const CALL_SHAPED_DEFAULT_SOURCES = new Set(['getInput', 'readFile', 'readFileSync', 'stdin']);
-const DEFAULT_HTTP_PROPERTY_SOURCES = new Set(['body', 'query', 'params', 'headers', 'cookies']);
-const DATABASE_MODULE_NAMES = new Set([
-    'db',
-    'database',
-    'sql',
-    'pool',
-    'client',
-    'repository',
-    'repo',
-]);
-const KNOWN_DATABASE_PACKAGES = new Set([
-    'pg',
-    'postgres',
-    'mysql',
-    'mysql2',
-    'sqlite3',
-    'better-sqlite3',
-    'knex',
-    'sequelize',
-    '@prisma/client',
-]);
 /**
  * Compute taint flows over the given code graph. Per-function callSites
  * are required (1.5+ ships these for every adapter); functions without
@@ -93,48 +86,8 @@ export function computeTaint(graph, config) {
     const sinks = new Set([...DEFAULT_TAINT_SINKS, ...config.sinks]);
     const customSources = new Set(config.sources);
     const customSinks = new Set(config.sinks);
-    const fnByQual = new Map();
-    const fnsByBareName = new Map();
-    let totalCallSites = 0;
-    for (const [file, gf] of graph.files) {
-        if (!gf.functions)
-            continue;
-        for (const fn of gf.functions) {
-            const callees = fn.callSites ?? [];
-            const directCallSites = fn.directCallSites ?? [];
-            const memberCallSites = fn.memberCallSites ?? [];
-            const memberReferences = fn.memberReferences ?? [];
-            const memberAliases = fn.memberAliases ?? [];
-            const references = fn.references ?? [];
-            totalCallSites += callees.length;
-            // Default sources mostly match property/reference reads; custom sources
-            // may still be call-shaped. Sinks are call-shaped, so callSites only.
-            const sourceHit = frameworkRequestSourceForFunction(file, fn.name, memberCallSites, memberReferences, fn.parameters ?? [], sources, references, fn.contextualCallSite, gf.imports) ?? pickSourceHit(callees, references, sources, customSources);
-            const sinkHit = pickSinkHit(callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks, file, gf);
-            const hasSource = sourceHit !== null;
-            const hasSink = sinkHit !== null;
-            const node = {
-                id: `${file}::${fn.name}@${fn.line}`,
-                qualName: fn.name,
-                bareName: bareName(fn.name),
-                file,
-                callees,
-                references,
-                sourceHit,
-                sinkHit,
-                hasSource,
-                hasSink,
-            };
-            fnByQual.set(node.id, node);
-            let list = fnsByBareName.get(node.bareName);
-            if (!list) {
-                list = [];
-                fnsByBareName.set(node.bareName, list);
-            }
-            list.push(node);
-        }
-    }
-    if (fnByQual.size === 0 || totalCallSites === 0) {
+    const index = buildTaintFunctionIndex(graph, sources, sinks, customSources, customSinks);
+    if (index.fnByQual.size === 0 || index.totalCallSites === 0) {
         return {
             available: false,
             reason: 'No functions with callSites in the graph. Taint requires per-function callSites (1.5+).',
@@ -144,204 +97,16 @@ export function computeTaint(graph, config) {
             effectiveSinks: [...sinks],
         };
     }
-    const flows = [];
-    const seen = new Set(); // dedupe key: sourceFnId::sinkFnId
-    // 1.8+ — track which source functions hit MAX_DEPTH with frontier
-    // still non-empty. The agent gets these in `truncatedSources` so it
-    // knows where the analysis was clipped.
-    const truncatedSources = [];
-    // 1.8+ — raised from 8 → 12. The original 8 was a conservative pick
-    // when the algorithm was new; six months of dogfood data show real
-    // user repos averaging 10–11 hops between an HTTP handler and a
-    // shell-exec sink. 12 catches those without exploding fan-out
-    // memory in the BFS frontier.
-    const MAX_DEPTH = 12;
-    // 1.10+ — per-step frontier cap. MAX_DEPTH bounds path length, but
-    // wide-fan-out graphs (Java/TS with prevalent get/set/toString bare-name
-    // collisions) can balloon the frontier exponentially: each step
-    // resolves every bare-name callee to every same-named function in the
-    // graph. Once a single step would push past this cap, we abort the
-    // remaining BFS for this source and surface it in `truncatedSources`,
-    // matching how MAX_DEPTH truncation is reported.
-    const MAX_FRONTIER_PER_STEP = 5000;
-    for (const sourceFn of fnByQual.values()) {
-        if (!sourceFn.hasSource)
-            continue;
-        // Same-function shortcut.
-        if (sourceFn.hasSink) {
-            const key = `${sourceFn.id}::${sourceFn.id}`;
-            if (!seen.has(key)) {
-                seen.add(key);
-                flows.push({
-                    sourceFn: sourceFn.qualName,
-                    sinkFn: sourceFn.qualName,
-                    source: sourceFn.sourceHit,
-                    sink: sourceFn.sinkHit,
-                    path: [sourceFn.qualName],
-                    files: [sourceFn.file],
-                });
-            }
-        }
-        // BFS through callees.
-        const visited = new Set([sourceFn.id]);
-        let frontier = [{ node: sourceFn, path: [sourceFn] }];
-        let depth = 0;
-        let frontierCapped = false;
-        while (frontier.length > 0 && depth < MAX_DEPTH) {
-            depth += 1;
-            const next = [];
-            let aborted = false;
-            for (const entry of frontier) {
-                if (aborted)
-                    break;
-                for (const calleeName of entry.node.callees) {
-                    const candidates = fnsByBareName.get(calleeName) ?? [];
-                    for (const candidate of candidates) {
-                        if (visited.has(candidate.id))
-                            continue;
-                        visited.add(candidate.id);
-                        const newPath = [...entry.path, candidate];
-                        if (candidate.hasSink) {
-                            const flowKey = `${sourceFn.id}::${candidate.id}`;
-                            if (!seen.has(flowKey)) {
-                                seen.add(flowKey);
-                                const filesInPath = [];
-                                for (const n of newPath) {
-                                    if (filesInPath[filesInPath.length - 1] !== n.file)
-                                        filesInPath.push(n.file);
-                                }
-                                flows.push({
-                                    sourceFn: sourceFn.qualName,
-                                    sinkFn: candidate.qualName,
-                                    source: sourceFn.sourceHit,
-                                    sink: candidate.sinkHit,
-                                    path: newPath.map((n) => n.qualName),
-                                    files: filesInPath,
-                                });
-                            }
-                            // Don't continue past a sink — the flow is reported.
-                            continue;
-                        }
-                        next.push({ node: candidate, path: newPath });
-                        if (next.length >= MAX_FRONTIER_PER_STEP) {
-                            // 1.10+ — per-step frontier cap reached. Abort this source's
-                            // BFS and surface it as truncated. Continuing would just
-                            // multiply: each entry in `next` will spawn its own bare-name
-                            // resolutions on the following step.
-                            frontierCapped = true;
-                            aborted = true;
-                            break;
-                        }
-                    }
-                    if (aborted)
-                        break;
-                }
-            }
-            frontier = next;
-        }
-        // If the BFS exited because of MAX_DEPTH or the per-step frontier cap
-        // (not because the frontier emptied), record the source so the caller
-        // knows flows beyond that point weren't explored.
-        if (frontier.length > 0 || frontierCapped) {
-            truncatedSources.push(sourceFn.qualName);
-        }
-    }
-    flows.sort((a, b) => {
-        if (a.sourceFn !== b.sourceFn)
-            return a.sourceFn.localeCompare(b.sourceFn);
-        return a.sinkFn.localeCompare(b.sinkFn);
-    });
+    const traversal = findTaintFlows(index);
     return {
         available: true,
-        flowCount: flows.length,
-        flows,
+        flowCount: traversal.flows.length,
+        flows: traversal.flows,
         effectiveSources: [...sources].sort(),
         effectiveSinks: [...sinks].sort(),
-        truncated: truncatedSources.length > 0,
-        truncatedSources: [...new Set(truncatedSources)].sort(),
-        maxDepth: MAX_DEPTH,
+        truncated: traversal.truncatedSources.length > 0,
+        truncatedSources: traversal.truncatedSources,
+        maxDepth: traversal.maxDepth,
     };
 }
-function pickSinkHit(callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks, file, graphFile) {
-    for (const callee of callees) {
-        if (!sinks.has(callee))
-            continue;
-        if (isDefaultMisidentifiedJavaScriptShellSink(callee, customSinks, file, graphFile))
-            continue;
-        if (isDefaultMisidentifiedDatabaseSink(callee, directCallSites, memberCallSites, memberAliases, customSinks, file, graphFile))
-            continue;
-        return callee;
-    }
-    return null;
-}
-function isDefaultMisidentifiedJavaScriptShellSink(callee, customSinks, file, graphFile) {
-    if (customSinks.has(callee))
-        return false;
-    if (!JAVASCRIPT_CHILD_PROCESS_SINKS.has(callee))
-        return false;
-    if (!isJavaScriptLikeFile(file, graphFile.adapterId))
-        return false;
-    return !graphFile.imports.some((imp) => (imp.source === 'node:child_process' || imp.source === 'child_process') &&
-        (imp.specifiers.includes(callee) || imp.specifiers.length === 0));
-}
-function isDefaultMisidentifiedDatabaseSink(callee, directCallSites, memberCallSites, memberAliases, customSinks, file, graphFile) {
-    if (customSinks.has(callee))
-        return false;
-    if (!DEFAULT_DATABASE_SINKS.has(callee))
-        return false;
-    if (!isJavaScriptLikeFile(file, graphFile.adapterId))
-        return false;
-    if (memberCallSites.some((member) => isDatabaseMemberCall(member, callee)))
-        return false;
-    if (directCallSites.includes(callee) && isImportedDatabaseHelper(callee, graphFile.imports))
-        return false;
-    if (directCallSites.includes(callee) &&
-        memberAliases.some((alias) => isDatabaseMemberAlias(alias, callee)))
-        return false;
-    return true;
-}
-function isDatabaseMemberCall(member, callee) {
-    const parts = member.split('.');
-    if (parts[parts.length - 1] !== callee)
-        return false;
-    const receiver = parts.length >= 2 ? parts[parts.length - 2].toLowerCase() : '';
-    return DATABASE_RECEIVERS.has(receiver);
-}
-function isImportedDatabaseHelper(callee, imports) {
-    return imports.some((imp) => imp.specifiers.includes(callee) && isDatabaseModule(imp.source));
-}
-function isDatabaseModule(source) {
-    if (KNOWN_DATABASE_PACKAGES.has(source))
-        return true;
-    const normalized = source.replace(/\\/g, '/');
-    const last = normalized.split('/').pop() ?? normalized;
-    const basename = last.replace(/\.(?:c|m)?(?:j|t)sx?$/i, '').toLowerCase();
-    return DATABASE_MODULE_NAMES.has(basename);
-}
-function isDatabaseMemberAlias(alias, callee) {
-    const [localName, member] = alias.split('=');
-    return localName === callee && isDatabaseMemberCall(member ?? '', callee);
-}
-function isJavaScriptLikeFile(file, adapterId) {
-    return adapterId === 'javascript' || /\.(?:cjs|mjs|js|jsx|ts|tsx)$/.test(file);
-}
-function bareName(qualified) {
-    const dot = qualified.lastIndexOf('.');
-    if (dot < 0)
-        return qualified;
-    return qualified.slice(dot + 1);
-}
-function pickSourceHit(callees, references, sources, customSources) {
-    for (const value of references) {
-        if (customSources.has(value))
-            return value;
-        if (sources.has(value) && !DEFAULT_HTTP_PROPERTY_SOURCES.has(value))
-            return value;
-    }
-    for (const value of callees) {
-        if (customSources.has(value) || CALL_SHAPED_DEFAULT_SOURCES.has(value))
-            return value;
-    }
-    return null;
-}
 //# sourceMappingURL=taint.js.map

package/dist/core/taint.js.map

@@ -1 +1 @@
-{"version":3,"file":"taint.js","sourceRoot":"","sources":["../../src/core/taint.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAyD/B,MAAM,CAAC,MAAM,qBAAqB,GAA0B;IAC1D,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,4EAA4E;IACrF,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,cAAc;IACzB,UAAU,EAAE,wBAAwB;IACpC,cAAc;IACd,OAAO,EAAE,gBAAgB;IACzB,UAAU,EAAE,wBAAwB;IACpC,GAAG,yBAAyB;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,MAAM,EAAE,qBAAqB;IAC7B,UAAU;IACV,OAAO,EAAE,sBAAsB;IAC/B,WAAW;IACX,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,yCAAyC;IACrD,WAAW,EAAE,6BAA6B;IAC1C,eAAe;IACf,QAAQ,EAAE,gCAAgC;IAC1C,QAAQ;IACR,IAAI;IACJ,OAAO,EAAE,uBAAuB;IAChC,SAAS,EAAE,yBAAyB;IACpC,QAAQ,EAAE,sBAAsB;IAChC,WAAW;IACX,YAAY,EAAE,2BAA2B;IACzC,WAAW,EAAE,wDAAwD;IACrE,kFAAkF;CACnF,CAAC;AAEF,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAC3F,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AAChG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,UAAU;IACV,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,MAAM;IACN,WAAW;IACX,YAAY;IACZ,MAAM;IACN,SAAS;IACT,KAAK;CACN,CAAC,CAAC;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/F,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACjG,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,IAAI;IACJ,UAAU;IACV,KAAK;IACL,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,MAAM;CACP,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,IAAI;IACJ,UAAU;IACV,OAAO;IACP,QAAQ;IACR,SAAS;IACT,gBAAgB;IAChB,MAAM;IACN,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC;AAgDH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgB,EAAE,MAAmB;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,qBAAqB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAkB1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,SAAS;YAAE,SAAS;QAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC;YACjD,MAAM,gBAAgB,GAAG,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC;YACnD,MAAM,aAAa,GAAG,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC;YACvC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;YACjC,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,SAAS,GACb,iCAAiC,CAC/B,IAAI,EACJ,EAAE,CAAC,IAAI,EACP,eAAe,EACf,gBAAgB,EAChB,EAAE,CAAC,UAAU,IAAI,EAAE,EACnB,OAAO,EACP,UAAU,EACV,EAAE,CAAC,kBAAkB,EACrB,EAAE,CAAC,OAAO,CACX,IAAI,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,WAAW,CACzB,OAAO,EACP,eAAe,EACf,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,IAAI,EACJ,EAAE,CACH,CAAC;YACF,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC;YACjC,MAAM,IAAI,GAAW;gBACnB,EAAE,EAAE,GAAG,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE;gBACpC,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC;gBAC3B,IAAI;gBACJ,OAAO;gBACP,UAAU;gBACV,SAAS;gBACT,OAAO;gBACP,SAAS;gBACT,OAAO;aACR,CAAC;YACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,EAAE,CAAC;gBACV,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,yFAAyF;YAC3F,SAAS,EAAE,CAAC;YACZ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC;YAC9B,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,mCAAmC;IACnE,kEAAkE;IAClE,oEAAoE;IACpE,wCAAwC;IACxC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,oEAAoE;IACpE,mEAAmE;IACnE,gEAAgE;IAChE,8DAA8D;IAC9D,8BAA8B;IAC9B,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,mEAAmE;IACnE,yEAAyE;IACzE,gEAAgE;IAChE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,qBAAqB,GAAG,IAAI,CAAC;IAEnC,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,SAAS;QAClC,0BAA0B;QAC1B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ;oBACzB,MAAM,EAAE,QAAQ,CAAC,SAAU;oBAC3B,IAAI,EAAE,QAAQ,CAAC,OAAQ;oBACvB,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACzB,KAAK,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,QAAQ,GAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,GAAoB,EAAE,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,IAAI,OAAO;oBAAE,MAAM;gBACnB,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;oBACvD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;4BAAE,SAAS;wBACxC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC3C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;4BACtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;4BAClD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gCACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gCAClB,MAAM,WAAW,GAAa,EAAE,CAAC;gCACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oCACxB,IAAI,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI;wCAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gCAC/E,CAAC;gCACD,KAAK,CAAC,IAAI,CAAC;oCACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oCAC3B,MAAM,EAAE,SAAS,CAAC,QAAQ;oCAC1B,MAAM,EAAE,QAAQ,CAAC,SAAU;oCAC3B,IAAI,EAAE,SAAS,CAAC,OAAQ;oCACxB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;oCACpC,KAAK,EAAE,WAAW;iCACnB,CAAC,CAAC;4BACL,CAAC;4BACD,qDAAqD;4BACrD,SAAS;wBACX,CAAC;wBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;wBAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;4BACzC,6DAA6D;4BAC7D,yDAAyD;4BACzD,8DAA8D;4BAC9D,qCAAqC;4BACrC,cAAc,GAAG,IAAI,CAAC;4BACtB,OAAO,GAAG,IAAI,CAAC;4BACf,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO;wBAAE,MAAM;gBACrB,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,sEAAsE;QACtE,sEAAsE;QACtE,kDAAkD;QAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;YAC1C,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,KAAK;QACL,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QACrC,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC;QACtC,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE;QACvD,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,OAAiB,EACjB,eAAyB,EACzB,eAAyB,EACzB,aAAuB,EACvB,KAAkB,EAClB,WAAwB,EACxB,IAAY,EACZ,SAA2F;IAE3F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACjC,IAAI,yCAAyC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC;YAAE,SAAS;QAC9F,IACE,kCAAkC,CAChC,MAAM,EACN,eAAe,EACf,eAAe,EACf,aAAa,EACb,WAAW,EACX,IAAI,EACJ,SAAS,CACV;YAED,SAAS;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yCAAyC,CAChD,MAAc,EACd,WAAwB,EACxB,IAAY,EACZ,SAA2F;IAE3F,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5B,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,GAAG,CAAC,MAAM,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;QACvE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CACzC,MAAc,EACd,eAAyB,EACzB,eAAyB,EACzB,aAAuB,EACvB,WAAwB,EACxB,IAAY,EACZ,SAA2F;IAE3F,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,IACE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEnE,OAAO,KAAK,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAc,EACd,OAAwD;IAExD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1E,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,MAAc;IAC1D,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,SAAS,KAAK,MAAM,IAAI,oBAAoB,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IAC5D,OAAO,SAAS,KAAK,YAAY,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CACpB,OAAiB,EACjB,UAAoB,EACpB,OAAoB,EACpB,aAA0B;IAE1B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACpF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"taint.js","sourceRoot":"","sources":["../../src/core/taint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAKrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAA0B;IAC1D,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,4EAA4E;IACrF,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,cAAc;IACzB,UAAU,EAAE,wBAAwB;IACpC,cAAc;IACd,OAAO,EAAE,gBAAgB;IACzB,UAAU,EAAE,wBAAwB;IACpC,GAAG,yBAAyB;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,MAAM,EAAE,qBAAqB;IAC7B,UAAU;IACV,OAAO,EAAE,sBAAsB;IAC/B,WAAW;IACX,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,yCAAyC;IACrD,WAAW,EAAE,6BAA6B;IAC1C,eAAe;IACf,QAAQ,EAAE,gCAAgC;IAC1C,QAAQ;IACR,IAAI;IACJ,OAAO,EAAE,uBAAuB;IAChC,SAAS,EAAE,yBAAyB;IACpC,QAAQ,EAAE,sBAAsB;IAChC,WAAW;IACX,YAAY,EAAE,2BAA2B;IACzC,WAAW,EAAE,wDAAwD;IACrE,kFAAkF;CACnF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgB,EAAE,MAAmB;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,qBAAqB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAEzF,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,yFAAyF;YAC3F,SAAS,EAAE,CAAC;YACZ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC;YAC9B,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAExC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;QACjC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QACrC,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,SAAS,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAChD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC"}

package/dist/core/taintIndex.d.ts

@@ -0,0 +1,20 @@
+import type { CodeGraph } from './codeGraph.js';
+export interface TaintFunctionNode {
+    id: string;
+    qualName: string;
+    bareName: string;
+    file: string;
+    callees: string[];
+    references: string[];
+    memberReferences: string[];
+    sourceHit: string | null;
+    sinkHit: string | null;
+    hasSource: boolean;
+    hasSink: boolean;
+}
+export interface TaintFunctionIndex {
+    fnByQual: Map<string, TaintFunctionNode>;
+    fnsByBareName: Map<string, TaintFunctionNode[]>;
+    totalCallSites: number;
+}
+export declare function buildTaintFunctionIndex(graph: CodeGraph, sources: Set<string>, sinks: Set<string>, customSources: Set<string>, customSinks: Set<string>): TaintFunctionIndex;

package/dist/core/taintIndex.js

@@ -0,0 +1,81 @@
+import { frameworkRequestSourceForFunction } from './frameworkSources.js';
+import { isDefaultChildProcessEnvPassthrough, pickSinkHit, pickSourceHit, } from './taintMatching.js';
+const EMPTY_STRING_ARRAY = [];
+export function buildTaintFunctionIndex(graph, sources, sinks, customSources, customSinks) {
+    const fnByQual = new Map();
+    const fnsByBareName = new Map();
+    let totalCallSites = 0;
+    for (const [file, graphFile] of graph.files) {
+        if (!graphFile.functions)
+            continue;
+        for (const fn of graphFile.functions) {
+            const node = buildTaintFunctionNode(file, graphFile, fn, sources, sinks, customSources, customSinks);
+            totalCallSites += node.callees.length;
+            fnByQual.set(node.id, node);
+            appendByBareName(fnsByBareName, node);
+        }
+    }
+    return { fnByQual, fnsByBareName, totalCallSites };
+}
+function buildTaintFunctionNode(file, graphFile, fn, sources, sinks, customSources, customSinks) {
+    const callees = optionalArray(fn.callSites);
+    const directCallSites = optionalArray(fn.directCallSites);
+    const memberCallSites = optionalArray(fn.memberCallSites);
+    const memberReferences = optionalArray(fn.memberReferences);
+    const memberAliases = optionalArray(fn.memberAliases);
+    const references = optionalArray(fn.references);
+    const sourceHit = resolveSourceHit(file, graphFile, fn, callees, directCallSites, memberCallSites, memberReferences, references, sources, customSources);
+    const sinkHit = resolveSinkHit(file, graphFile, callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks);
+    return {
+        id: `${file}::${fn.name}@${fn.line}`,
+        qualName: fn.name,
+        bareName: bareName(fn.name),
+        file,
+        callees,
+        references,
+        memberReferences,
+        sourceHit,
+        sinkHit,
+        hasSource: isActiveSourceHit(sourceHit, sinkHit, memberReferences, customSources, customSinks),
+        hasSink: sinkHit !== null,
+    };
+}
+function resolveSourceHit(file, graphFile, fn, callees, directCallSites, memberCallSites, memberReferences, references, sources, customSources) {
+    return (frameworkRequestSourceForFunction({
+        file,
+        functionName: fn.name,
+        memberCallSites,
+        memberReferences,
+        parameters: fn.parameters ?? [],
+        enabledSources: sources,
+        references,
+        contextualCallSite: fn.contextualCallSite,
+        imports: graphFile.imports,
+        directCallSites,
+    }) ?? pickSourceHit(callees, references, sources, customSources));
+}
+function resolveSinkHit(file, graphFile, callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks) {
+    return pickSinkHit(callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks, file, graphFile);
+}
+function isActiveSourceHit(sourceHit, sinkHit, memberReferences, customSources, customSinks) {
+    return (sourceHit !== null &&
+        !isDefaultChildProcessEnvPassthrough(sourceHit, sinkHit, memberReferences, customSources, customSinks));
+}
+function appendByBareName(fnsByBareName, node) {
+    const existing = fnsByBareName.get(node.bareName);
+    if (existing) {
+        existing.push(node);
+        return;
+    }
+    fnsByBareName.set(node.bareName, [node]);
+}
+function optionalArray(values) {
+    return values ?? EMPTY_STRING_ARRAY;
+}
+function bareName(qualified) {
+    const dot = qualified.lastIndexOf('.');
+    if (dot < 0)
+        return qualified;
+    return qualified.slice(dot + 1);
+}
+//# sourceMappingURL=taintIndex.js.map

package/dist/core/taintIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taintIndex.js","sourceRoot":"","sources":["../../src/core/taintIndex.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,WAAW,EACX,aAAa,GACd,MAAM,oBAAoB,CAAC;AAuB5B,MAAM,kBAAkB,GAAa,EAAE,CAAC;AAExC,MAAM,UAAU,uBAAuB,CACrC,KAAgB,EAChB,OAAoB,EACpB,KAAkB,EAClB,aAA0B,EAC1B,WAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC7D,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,sBAAsB,CACjC,IAAI,EACJ,SAAS,EACT,EAAE,EACF,OAAO,EACP,KAAK,EACL,aAAa,EACb,WAAW,CACZ,CAAC;YACF,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5B,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAY,EACZ,SAAoB,EACpB,EAAiB,EACjB,OAAoB,EACpB,KAAkB,EAClB,aAA0B,EAC1B,WAAwB;IAExB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,aAAa,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,aAAa,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,aAAa,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,aAAa,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,aAAa,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,gBAAgB,CAChC,IAAI,EACJ,SAAS,EACT,EAAE,EACF,OAAO,EACP,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,CACd,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAC5B,IAAI,EACJ,SAAS,EACT,OAAO,EACP,eAAe,EACf,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,CACZ,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,GAAG,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE;QACpC,QAAQ,EAAE,EAAE,CAAC,IAAI;QACjB,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC;QAC3B,IAAI;QACJ,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,SAAS;QACT,OAAO;QACP,SAAS,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,CAAC;QAC9F,OAAO,EAAE,OAAO,KAAK,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAoB,EACpB,EAAiB,EACjB,OAAiB,EACjB,eAAyB,EACzB,eAAyB,EACzB,gBAA0B,EAC1B,UAAoB,EACpB,OAAoB,EACpB,aAA0B;IAE1B,OAAO,CACL,iCAAiC,CAAC;QAChC,IAAI;QACJ,YAAY,EAAE,EAAE,CAAC,IAAI;QACrB,eAAe;QACf,gBAAgB;QAChB,UAAU,EAAE,EAAE,CAAC,UAAU,IAAI,EAAE;QAC/B,cAAc,EAAE,OAAO;QACvB,UAAU;QACV,kBAAkB,EAAE,EAAE,CAAC,kBAAkB;QACzC,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,eAAe;KAChB,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,SAAoB,EACpB,OAAiB,EACjB,eAAyB,EACzB,eAAyB,EACzB,aAAuB,EACvB,KAAkB,EAClB,WAAwB;IAExB,OAAO,WAAW,CAChB,OAAO,EACP,eAAe,EACf,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAwB,EACxB,OAAsB,EACtB,gBAA0B,EAC1B,aAA0B,EAC1B,WAAwB;IAExB,OAAO,CACL,SAAS,KAAK,IAAI;QAClB,CAAC,mCAAmC,CAClC,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,aAAa,EACb,WAAW,CACZ,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,aAA+C,EAC/C,IAAuB;IAEvB,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,MAA4B;IACjD,OAAO,MAAM,IAAI,kBAAkB,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/core/taintMatching.d.ts

@@ -0,0 +1,11 @@
+type TaintGraphFile = {
+    imports: Array<{
+        source: string;
+        specifiers: string[];
+    }>;
+    adapterId?: string;
+};
+export declare function pickSourceHit(callees: string[], references: string[], sources: Set<string>, customSources: Set<string>): string | null;
+export declare function pickSinkHit(callees: string[], directCallSites: string[], memberCallSites: string[], memberAliases: string[], sinks: Set<string>, customSinks: Set<string>, file: string, graphFile: TaintGraphFile): string | null;
+export declare function isDefaultChildProcessEnvPassthrough(sourceHit: string, sinkHit: string | null, memberReferences: string[], customSources: Set<string>, customSinks: Set<string>): boolean;
+export {};

package/dist/core/taintMatching.js

@@ -0,0 +1,126 @@
+const JAVASCRIPT_CHILD_PROCESS_SINKS = new Set(['exec', 'execSync', 'spawn', 'spawnSync']);
+const DEFAULT_DATABASE_SINKS = new Set(['query', 'execute', '$queryRaw', '$executeRaw', 'raw']);
+const DATABASE_RECEIVERS = new Set([
+    'db',
+    'database',
+    'pool',
+    'client',
+    'connection',
+    'conn',
+    'prisma',
+    'knex',
+    'sequelize',
+    'repository',
+    'repo',
+    'manager',
+    'sql',
+]);
+const CALL_SHAPED_DEFAULT_SOURCES = new Set(['getInput', 'readFile', 'readFileSync', 'stdin']);
+const DEFAULT_HTTP_PROPERTY_SOURCES = new Set(['body', 'query', 'params', 'headers', 'cookies']);
+const DATABASE_MODULE_NAMES = new Set([
+    'db',
+    'database',
+    'sql',
+    'pool',
+    'client',
+    'repository',
+    'repo',
+]);
+const KNOWN_DATABASE_PACKAGES = new Set([
+    'pg',
+    'postgres',
+    'mysql',
+    'mysql2',
+    'sqlite3',
+    'better-sqlite3',
+    'knex',
+    'sequelize',
+    '@prisma/client',
+]);
+export function pickSourceHit(callees, references, sources, customSources) {
+    for (const value of references) {
+        if (customSources.has(value))
+            return value;
+        if (sources.has(value) && !DEFAULT_HTTP_PROPERTY_SOURCES.has(value))
+            return value;
+    }
+    for (const value of callees) {
+        if (customSources.has(value) || CALL_SHAPED_DEFAULT_SOURCES.has(value))
+            return value;
+    }
+    return null;
+}
+export function pickSinkHit(callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks, file, graphFile) {
+    for (const callee of callees) {
+        if (!sinks.has(callee))
+            continue;
+        if (isDefaultMisidentifiedJavaScriptShellSink(callee, customSinks, file, graphFile))
+            continue;
+        if (isDefaultMisidentifiedDatabaseSink(callee, directCallSites, memberCallSites, memberAliases, customSinks, file, graphFile))
+            continue;
+        return callee;
+    }
+    return null;
+}
+export function isDefaultChildProcessEnvPassthrough(sourceHit, sinkHit, memberReferences, customSources, customSinks) {
+    if (sourceHit !== 'env')
+        return false;
+    if (!sinkHit || !JAVASCRIPT_CHILD_PROCESS_SINKS.has(sinkHit))
+        return false;
+    if (customSources.has(sourceHit) || customSinks.has(sinkHit))
+        return false;
+    return (memberReferences.includes('process.env') &&
+        !memberReferences.some((reference) => reference.startsWith('process.env.')));
+}
+function isDefaultMisidentifiedJavaScriptShellSink(callee, customSinks, file, graphFile) {
+    if (customSinks.has(callee))
+        return false;
+    if (!JAVASCRIPT_CHILD_PROCESS_SINKS.has(callee))
+        return false;
+    if (!isJavaScriptLikeFile(file, graphFile.adapterId))
+        return false;
+    return !graphFile.imports.some((imp) => (imp.source === 'node:child_process' || imp.source === 'child_process') &&
+        (imp.specifiers.includes(callee) || imp.specifiers.length === 0));
+}
+function isDefaultMisidentifiedDatabaseSink(callee, directCallSites, memberCallSites, memberAliases, customSinks, file, graphFile) {
+    if (customSinks.has(callee))
+        return false;
+    if (!DEFAULT_DATABASE_SINKS.has(callee))
+        return false;
+    if (!isJavaScriptLikeFile(file, graphFile.adapterId))
+        return false;
+    if (memberCallSites.some((member) => isDatabaseMemberCall(member, callee)))
+        return false;
+    if (directCallSites.includes(callee) && isImportedDatabaseHelper(callee, graphFile.imports))
+        return false;
+    if (directCallSites.includes(callee) &&
+        memberAliases.some((alias) => isDatabaseMemberAlias(alias, callee)))
+        return false;
+    return true;
+}
+function isDatabaseMemberCall(member, callee) {
+    const parts = member.split('.');
+    if (parts[parts.length - 1] !== callee)
+        return false;
+    const receiver = parts.length >= 2 ? parts[parts.length - 2].toLowerCase() : '';
+    return DATABASE_RECEIVERS.has(receiver);
+}
+function isImportedDatabaseHelper(callee, imports) {
+    return imports.some((imp) => imp.specifiers.includes(callee) && isDatabaseModule(imp.source));
+}
+function isDatabaseModule(source) {
+    if (KNOWN_DATABASE_PACKAGES.has(source))
+        return true;
+    const normalized = source.replace(/\\/g, '/');
+    const last = normalized.split('/').pop() ?? normalized;
+    const basename = last.replace(/\.(?:c|m)?(?:j|t)sx?$/i, '').toLowerCase();
+    return DATABASE_MODULE_NAMES.has(basename);
+}
+function isDatabaseMemberAlias(alias, callee) {
+    const [localName, member] = alias.split('=');
+    return localName === callee && isDatabaseMemberCall(member ?? '', callee);
+}
+function isJavaScriptLikeFile(file, adapterId) {
+    return adapterId === 'javascript' || /\.(?:cjs|mjs|js|jsx|ts|tsx)$/.test(file);
+}
+//# sourceMappingURL=taintMatching.js.map

package/dist/core/taintMatching.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taintMatching.js","sourceRoot":"","sources":["../../src/core/taintMatching.ts"],"names":[],"mappings":"AAAA,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAC3F,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;AAChG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,IAAI;IACJ,UAAU;IACV,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,MAAM;IACN,WAAW;IACX,YAAY;IACZ,MAAM;IACN,SAAS;IACT,KAAK;CACN,CAAC,CAAC;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/F,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AACjG,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,IAAI;IACJ,UAAU;IACV,KAAK;IACL,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,MAAM;CACP,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,IAAI;IACJ,UAAU;IACV,OAAO;IACP,QAAQ;IACR,SAAS;IACT,gBAAgB;IAChB,MAAM;IACN,WAAW;IACX,gBAAgB;CACjB,CAAC,CAAC;AAOH,MAAM,UAAU,aAAa,CAC3B,OAAiB,EACjB,UAAoB,EACpB,OAAoB,EACpB,aAA0B;IAE1B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACpF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAiB,EACjB,eAAyB,EACzB,eAAyB,EACzB,aAAuB,EACvB,KAAkB,EAClB,WAAwB,EACxB,IAAY,EACZ,SAAyB;IAEzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACjC,IAAI,yCAAyC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC;YAAE,SAAS;QAC9F,IACE,kCAAkC,CAChC,MAAM,EACN,eAAe,EACf,eAAe,EACf,aAAa,EACb,WAAW,EACX,IAAI,EACJ,SAAS,CACV;YAED,SAAS;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,SAAiB,EACjB,OAAsB,EACtB,gBAA0B,EAC1B,aAA0B,EAC1B,WAAwB;IAExB,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,OAAO,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,CACL,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC;QACxC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,yCAAyC,CAChD,MAAc,EACd,WAAwB,EACxB,IAAY,EACZ,SAAyB;IAEzB,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5B,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,GAAG,CAAC,MAAM,KAAK,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,CAAC;QACvE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,SAAS,kCAAkC,CACzC,MAAc,EACd,eAAyB,EACzB,eAAyB,EACzB,aAAuB,EACvB,WAAwB,EACxB,IAAY,EACZ,SAAyB;IAEzB,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,IACE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEnE,OAAO,KAAK,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,MAAc;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAc,EACd,OAAwD;IAExD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1E,OAAO,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,MAAc;IAC1D,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,SAAS,KAAK,MAAM,IAAI,oBAAoB,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,SAAkB;IAC5D,OAAO,SAAS,KAAK,YAAY,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC"}

package/dist/core/taintTraversal.d.ts

@@ -0,0 +1,8 @@
+import type { TaintFunctionIndex } from './taintIndex.js';
+import type { TaintFlow } from './taintTypes.js';
+export interface TaintTraversalResult {
+    flows: TaintFlow[];
+    truncatedSources: string[];
+    maxDepth: number;
+}
+export declare function findTaintFlows(index: TaintFunctionIndex): TaintTraversalResult;