projscan 4.6.0 → 4.8.0

package/dist/core/taint.d.ts

@@ -1,4 +1,6 @@
 import type { CodeGraph } from './codeGraph.js';
+import type { TaintConfig, TaintReport } from './taintTypes.js';
+export type { TaintConfig, TaintFlow, TaintReport } from './taintTypes.js';
 /**
  * Lightweight taint flow analysis (1.6+).
  *
@@ -29,75 +31,8 @@ import type { CodeGraph } from './codeGraph.js';
  * variable-level dataflow, no AST inspection beyond what callSites
  * already gives us. If this drifts toward "general dataflow" cut it.
  */
-export interface TaintConfig {
-    /**
-     * Bare callee names treated as taint sources. Examples:
-     *   "process.env"        — environment variables (read sensitive config)
-     *   "req.body"           — HTTP request body
-     *   "readFileSync"       — disk read (could be user-controlled paths)
-     *
-     * Match is by bare name (the rightmost identifier in a member-access
-     * chain). "process.env.SECRET" → "env"; "req.body.userId" → "body".
-     * The default list captures the most common JS / Python / Go sources;
-     * users override via .projscanrc taint.sources.
-     */
-    sources: string[];
-    /**
-     * Bare callee names treated as taint sinks. Examples:
-     *   "exec"               — child_process.exec
-     *   "spawn"              — child_process.spawn
-     *   "writeFile"          — fs.writeFile
-     *   "query"              — raw SQL (db.query("SELECT...${user}"))
-     *   "eval"               — JS eval / Python eval / etc.
-     */
-    sinks: string[];
-}
 export declare const DEFAULT_TAINT_SOURCES: ReadonlyArray<string>;
 export declare const DEFAULT_TAINT_SINKS: ReadonlyArray<string>;
-export interface TaintFlow {
-    /** Bare function name where the source was called. */
-    sourceFn: string;
-    /** Bare function name where the sink was called. */
-    sinkFn: string;
-    /** The source identifier (e.g. "env"). */
-    source: string;
-    /** The sink identifier (e.g. "exec"). */
-    sink: string;
-    /**
-     * Sequence of fully-qualified function names from sourceFn to sinkFn,
-     * inclusive at both ends. Length 1 means the same function reads the
-     * source and calls the sink (the most direct flow).
-     */
-    path: string[];
-    /** Files touched by the path (in order, deduped). */
-    files: string[];
-}
-export interface TaintReport {
-    available: boolean;
-    reason?: string;
-    flowCount: number;
-    flows: TaintFlow[];
-    /** The effective sources/sinks list used for this run (after merging defaults + config). */
-    effectiveSources: string[];
-    effectiveSinks: string[];
-    /**
-     * 1.8+ — true when the BFS hit MAX_DEPTH for at least one source with
-     * a non-empty frontier still pending. When set, the agent should know
-     * that flows deeper than MAX_DEPTH may exist but weren't reported.
-     * Pairs with `truncatedSources` so a follow-up scan can re-target.
-     */
-    truncated?: boolean;
-    /**
-     * 1.8+ — function names whose BFS exited at MAX_DEPTH with the
-     * frontier non-empty. Empty when no truncation occurred.
-     */
-    truncatedSources?: string[];
-    /**
-     * 1.8+ — the depth cap actually used. Surfacing this lets agents
-     * notice when projscan's defaults shift between releases.
-     */
-    maxDepth?: number;
-}
 /**
  * Compute taint flows over the given code graph. Per-function callSites
  * are required (1.5+ ships these for every adapter); functions without

package/dist/core/taint.js

@@ -1,5 +1,36 @@
-import { FRAMEWORK_REQUEST_SOURCES, frameworkRequestSourceForFunction, } from './frameworkSources.js';
-import { isDefaultChildProcessEnvPassthrough, pickSinkHit, pickSourceHit, } from './taintMatching.js';
+import { FRAMEWORK_REQUEST_SOURCES } from './frameworkSources.js';
+import { buildTaintFunctionIndex } from './taintIndex.js';
+import { findTaintFlows } from './taintTraversal.js';
+/**
+ * Lightweight taint flow analysis (1.6+).
+ *
+ * Source-to-sink reachability over the existing per-function call
+ * graph. Sources and sinks are *declared* by name (config-driven);
+ * anything in between is treated as a function that might propagate
+ * taint. We do NOT do general dataflow — we only ask "does some
+ * call chain reach from a function that calls a source to a function
+ * that calls a sink?"
+ *
+ * That heuristic catches the common case: a route handler reads
+ * `process.env.SECRET` (source) and somewhere downstream it ends up
+ * in `child_process.spawn` (sink). It misses any flow that goes
+ * through code we can't see (eval'd strings, plugin loaders), and it
+ * over-reports when functions read sources but launder them safely
+ * before reaching sinks. Both are documented limitations.
+ *
+ * Legacy taint algorithm gap (1.6+): the "bridge-helper" pattern is missed —
+ * `function bridge() { const v = getSecret(); runDangerous(v); }` where
+ * `getSecret` reads the source and `runDangerous` is the sink. The BFS
+ * walks DOWN from source-fns, but `bridge` has neither source nor sink
+ * directly; both are its callees. 3.0's `computeDataflow` /
+ * `projscan_dataflow` runs that second algorithm and review surfaces it
+ * as `newDataflowRisks`. Keep this legacy function as the compatibility
+ * source-to-sink reachability report.
+ *
+ * Strict scope discipline (per ROADMAP 1.6 guardrail): no CFG, no
+ * variable-level dataflow, no AST inspection beyond what callSites
+ * already gives us. If this drifts toward "general dataflow" cut it.
+ */
 export const DEFAULT_TAINT_SOURCES = [
     'env', // process.env.X
     'argv', // process.argv
@@ -55,50 +86,8 @@ export function computeTaint(graph, config) {
     const sinks = new Set([...DEFAULT_TAINT_SINKS, ...config.sinks]);
     const customSources = new Set(config.sources);
     const customSinks = new Set(config.sinks);
-    const fnByQual = new Map();
-    const fnsByBareName = new Map();
-    let totalCallSites = 0;
-    for (const [file, gf] of graph.files) {
-        if (!gf.functions)
-            continue;
-        for (const fn of gf.functions) {
-            const callees = fn.callSites ?? [];
-            const directCallSites = fn.directCallSites ?? [];
-            const memberCallSites = fn.memberCallSites ?? [];
-            const memberReferences = fn.memberReferences ?? [];
-            const memberAliases = fn.memberAliases ?? [];
-            const references = fn.references ?? [];
-            totalCallSites += callees.length;
-            // Default sources mostly match property/reference reads; custom sources
-            // may still be call-shaped. Sinks are call-shaped, so callSites only.
-            const sourceHit = frameworkRequestSourceForFunction(file, fn.name, memberCallSites, memberReferences, fn.parameters ?? [], sources, references, fn.contextualCallSite, gf.imports) ?? pickSourceHit(callees, references, sources, customSources);
-            const sinkHit = pickSinkHit(callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks, file, gf);
-            const hasSource = sourceHit !== null &&
-                !isDefaultChildProcessEnvPassthrough(sourceHit, sinkHit, memberReferences, customSources, customSinks);
-            const hasSink = sinkHit !== null;
-            const node = {
-                id: `${file}::${fn.name}@${fn.line}`,
-                qualName: fn.name,
-                bareName: bareName(fn.name),
-                file,
-                callees,
-                references,
-                memberReferences,
-                sourceHit,
-                sinkHit,
-                hasSource,
-                hasSink,
-            };
-            fnByQual.set(node.id, node);
-            let list = fnsByBareName.get(node.bareName);
-            if (!list) {
-                list = [];
-                fnsByBareName.set(node.bareName, list);
-            }
-            list.push(node);
-        }
-    }
-    if (fnByQual.size === 0 || totalCallSites === 0) {
+    const index = buildTaintFunctionIndex(graph, sources, sinks, customSources, customSinks);
+    if (index.fnByQual.size === 0 || index.totalCallSites === 0) {
         return {
             available: false,
             reason: 'No functions with callSites in the graph. Taint requires per-function callSites (1.5+).',
@@ -108,128 +97,16 @@ export function computeTaint(graph, config) {
             effectiveSinks: [...sinks],
         };
     }
-    const flows = [];
-    const seen = new Set(); // dedupe key: sourceFnId::sinkFnId
-    // 1.8+ — track which source functions hit MAX_DEPTH with frontier
-    // still non-empty. The agent gets these in `truncatedSources` so it
-    // knows where the analysis was clipped.
-    const truncatedSources = [];
-    // 1.8+ — raised from 8 → 12. The original 8 was a conservative pick
-    // when the algorithm was new; six months of dogfood data show real
-    // user repos averaging 10–11 hops between an HTTP handler and a
-    // shell-exec sink. 12 catches those without exploding fan-out
-    // memory in the BFS frontier.
-    const MAX_DEPTH = 12;
-    // 1.10+ — per-step frontier cap. MAX_DEPTH bounds path length, but
-    // wide-fan-out graphs (Java/TS with prevalent get/set/toString bare-name
-    // collisions) can balloon the frontier exponentially: each step
-    // resolves every bare-name callee to every same-named function in the
-    // graph. Once a single step would push past this cap, we abort the
-    // remaining BFS for this source and surface it in `truncatedSources`,
-    // matching how MAX_DEPTH truncation is reported.
-    const MAX_FRONTIER_PER_STEP = 5000;
-    for (const sourceFn of fnByQual.values()) {
-        if (!sourceFn.hasSource)
-            continue;
-        // Same-function shortcut.
-        if (sourceFn.hasSink) {
-            const key = `${sourceFn.id}::${sourceFn.id}`;
-            if (!seen.has(key)) {
-                seen.add(key);
-                flows.push({
-                    sourceFn: sourceFn.qualName,
-                    sinkFn: sourceFn.qualName,
-                    source: sourceFn.sourceHit,
-                    sink: sourceFn.sinkHit,
-                    path: [sourceFn.qualName],
-                    files: [sourceFn.file],
-                });
-            }
-        }
-        // BFS through callees.
-        const visited = new Set([sourceFn.id]);
-        let frontier = [{ node: sourceFn, path: [sourceFn] }];
-        let depth = 0;
-        let frontierCapped = false;
-        while (frontier.length > 0 && depth < MAX_DEPTH) {
-            depth += 1;
-            const next = [];
-            let aborted = false;
-            for (const entry of frontier) {
-                if (aborted)
-                    break;
-                for (const calleeName of entry.node.callees) {
-                    const candidates = fnsByBareName.get(calleeName) ?? [];
-                    for (const candidate of candidates) {
-                        if (visited.has(candidate.id))
-                            continue;
-                        visited.add(candidate.id);
-                        const newPath = [...entry.path, candidate];
-                        if (candidate.hasSink) {
-                            const flowKey = `${sourceFn.id}::${candidate.id}`;
-                            if (!seen.has(flowKey)) {
-                                seen.add(flowKey);
-                                const filesInPath = [];
-                                for (const n of newPath) {
-                                    if (filesInPath[filesInPath.length - 1] !== n.file)
-                                        filesInPath.push(n.file);
-                                }
-                                flows.push({
-                                    sourceFn: sourceFn.qualName,
-                                    sinkFn: candidate.qualName,
-                                    source: sourceFn.sourceHit,
-                                    sink: candidate.sinkHit,
-                                    path: newPath.map((n) => n.qualName),
-                                    files: filesInPath,
-                                });
-                            }
-                            // Don't continue past a sink — the flow is reported.
-                            continue;
-                        }
-                        next.push({ node: candidate, path: newPath });
-                        if (next.length >= MAX_FRONTIER_PER_STEP) {
-                            // 1.10+ — per-step frontier cap reached. Abort this source's
-                            // BFS and surface it as truncated. Continuing would just
-                            // multiply: each entry in `next` will spawn its own bare-name
-                            // resolutions on the following step.
-                            frontierCapped = true;
-                            aborted = true;
-                            break;
-                        }
-                    }
-                    if (aborted)
-                        break;
-                }
-            }
-            frontier = next;
-        }
-        // If the BFS exited because of MAX_DEPTH or the per-step frontier cap
-        // (not because the frontier emptied), record the source so the caller
-        // knows flows beyond that point weren't explored.
-        if (frontier.length > 0 || frontierCapped) {
-            truncatedSources.push(sourceFn.qualName);
-        }
-    }
-    flows.sort((a, b) => {
-        if (a.sourceFn !== b.sourceFn)
-            return a.sourceFn.localeCompare(b.sourceFn);
-        return a.sinkFn.localeCompare(b.sinkFn);
-    });
+    const traversal = findTaintFlows(index);
     return {
         available: true,
-        flowCount: flows.length,
-        flows,
+        flowCount: traversal.flows.length,
+        flows: traversal.flows,
         effectiveSources: [...sources].sort(),
         effectiveSinks: [...sinks].sort(),
-        truncated: truncatedSources.length > 0,
-        truncatedSources: [...new Set(truncatedSources)].sort(),
-        maxDepth: MAX_DEPTH,
+        truncated: traversal.truncatedSources.length > 0,
+        truncatedSources: traversal.truncatedSources,
+        maxDepth: traversal.maxDepth,
     };
 }
-function bareName(qualified) {
-    const dot = qualified.lastIndexOf('.');
-    if (dot < 0)
-        return qualified;
-    return qualified.slice(dot + 1);
-}
 //# sourceMappingURL=taint.js.map

package/dist/core/taint.js.map

@@ -1 +1 @@
-{"version":3,"file":"taint.js","sourceRoot":"","sources":["../../src/core/taint.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mCAAmC,EACnC,WAAW,EACX,aAAa,GACd,MAAM,oBAAoB,CAAC;AAyD5B,MAAM,CAAC,MAAM,qBAAqB,GAA0B;IAC1D,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,4EAA4E;IACrF,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,cAAc;IACzB,UAAU,EAAE,wBAAwB;IACpC,cAAc;IACd,OAAO,EAAE,gBAAgB;IACzB,UAAU,EAAE,wBAAwB;IACpC,GAAG,yBAAyB;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,MAAM,EAAE,qBAAqB;IAC7B,UAAU;IACV,OAAO,EAAE,sBAAsB;IAC/B,WAAW;IACX,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,yCAAyC;IACrD,WAAW,EAAE,6BAA6B;IAC1C,eAAe;IACf,QAAQ,EAAE,gCAAgC;IAC1C,QAAQ;IACR,IAAI;IACJ,OAAO,EAAE,uBAAuB;IAChC,SAAS,EAAE,yBAAyB;IACpC,QAAQ,EAAE,sBAAsB;IAChC,WAAW;IACX,YAAY,EAAE,2BAA2B;IACzC,WAAW,EAAE,wDAAwD;IACrE,kFAAkF;CACnF,CAAC;AAgDF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgB,EAAE,MAAmB;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,qBAAqB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAmB1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,SAAS;YAAE,SAAS;QAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC;YACjD,MAAM,eAAe,GAAG,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC;YACjD,MAAM,gBAAgB,GAAG,EAAE,CAAC,gBAAgB,IAAI,EAAE,CAAC;YACnD,MAAM,aAAa,GAAG,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC;YACvC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;YACjC,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,SAAS,GACb,iCAAiC,CAC/B,IAAI,EACJ,EAAE,CAAC,IAAI,EACP,eAAe,EACf,gBAAgB,EAChB,EAAE,CAAC,UAAU,IAAI,EAAE,EACnB,OAAO,EACP,UAAU,EACV,EAAE,CAAC,kBAAkB,EACrB,EAAE,CAAC,OAAO,CACX,IAAI,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,WAAW,CACzB,OAAO,EACP,eAAe,EACf,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,IAAI,EACJ,EAAE,CACH,CAAC;YACF,MAAM,SAAS,GACb,SAAS,KAAK,IAAI;gBAClB,CAAC,mCAAmC,CAClC,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,aAAa,EACb,WAAW,CACZ,CAAC;YACJ,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC;YACjC,MAAM,IAAI,GAAW;gBACnB,EAAE,EAAE,GAAG,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE;gBACpC,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC;gBAC3B,IAAI;gBACJ,OAAO;gBACP,UAAU;gBACV,gBAAgB;gBAChB,SAAS;gBACT,OAAO;gBACP,SAAS;gBACT,OAAO;aACR,CAAC;YACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5B,IAAI,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,EAAE,CAAC;gBACV,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,yFAAyF;YAC3F,SAAS,EAAE,CAAC;YACZ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC;YAC9B,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,mCAAmC;IACnE,kEAAkE;IAClE,oEAAoE;IACpE,wCAAwC;IACxC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,oEAAoE;IACpE,mEAAmE;IACnE,gEAAgE;IAChE,8DAA8D;IAC9D,8BAA8B;IAC9B,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,mEAAmE;IACnE,yEAAyE;IACzE,gEAAgE;IAChE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,iDAAiD;IACjD,MAAM,qBAAqB,GAAG,IAAI,CAAC;IAEnC,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,SAAS;QAClC,0BAA0B;QAC1B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ;oBACzB,MAAM,EAAE,QAAQ,CAAC,SAAU;oBAC3B,IAAI,EAAE,QAAQ,CAAC,OAAQ;oBACvB,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACzB,KAAK,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAE/C,IAAI,QAAQ,GAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YAChD,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,GAAoB,EAAE,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,IAAI,OAAO;oBAAE,MAAM;gBACnB,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC5C,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;oBACvD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;4BAAE,SAAS;wBACxC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;wBAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC3C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;4BACtB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;4BAClD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gCACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gCAClB,MAAM,WAAW,GAAa,EAAE,CAAC;gCACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oCACxB,IAAI,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI;wCAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gCAC/E,CAAC;gCACD,KAAK,CAAC,IAAI,CAAC;oCACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oCAC3B,MAAM,EAAE,SAAS,CAAC,QAAQ;oCAC1B,MAAM,EAAE,QAAQ,CAAC,SAAU;oCAC3B,IAAI,EAAE,SAAS,CAAC,OAAQ;oCACxB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;oCACpC,KAAK,EAAE,WAAW;iCACnB,CAAC,CAAC;4BACL,CAAC;4BACD,qDAAqD;4BACrD,SAAS;wBACX,CAAC;wBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;wBAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;4BACzC,6DAA6D;4BAC7D,yDAAyD;4BACzD,8DAA8D;4BAC9D,qCAAqC;4BACrC,cAAc,GAAG,IAAI,CAAC;4BACtB,OAAO,GAAG,IAAI,CAAC;4BACf,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO;wBAAE,MAAM;gBACrB,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,sEAAsE;QACtE,sEAAsE;QACtE,kDAAkD;QAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;YAC1C,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,KAAK;QACL,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QACrC,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC;QACtC,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE;QACvD,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"taint.js","sourceRoot":"","sources":["../../src/core/taint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAKrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAA0B;IAC1D,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,4EAA4E;IACrF,QAAQ,EAAE,aAAa;IACvB,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,cAAc;IACzB,UAAU,EAAE,wBAAwB;IACpC,cAAc;IACd,OAAO,EAAE,gBAAgB;IACzB,UAAU,EAAE,wBAAwB;IACpC,GAAG,yBAAyB;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,MAAM,EAAE,qBAAqB;IAC7B,UAAU;IACV,OAAO,EAAE,sBAAsB;IAC/B,WAAW;IACX,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,yCAAyC;IACrD,WAAW,EAAE,6BAA6B;IAC1C,eAAe;IACf,QAAQ,EAAE,gCAAgC;IAC1C,QAAQ;IACR,IAAI;IACJ,OAAO,EAAE,uBAAuB;IAChC,SAAS,EAAE,yBAAyB;IACpC,QAAQ,EAAE,sBAAsB;IAChC,WAAW;IACX,YAAY,EAAE,2BAA2B;IACzC,WAAW,EAAE,wDAAwD;IACrE,kFAAkF;CACnF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgB,EAAE,MAAmB;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,qBAAqB,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IAEzF,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,yFAAyF;YAC3F,SAAS,EAAE,CAAC;YACZ,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC;YAC9B,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAExC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;QACjC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;QACrC,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE;QACjC,SAAS,EAAE,SAAS,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAChD,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC"}

package/dist/core/taintIndex.d.ts

@@ -0,0 +1,20 @@
+import type { CodeGraph } from './codeGraph.js';
+export interface TaintFunctionNode {
+    id: string;
+    qualName: string;
+    bareName: string;
+    file: string;
+    callees: string[];
+    references: string[];
+    memberReferences: string[];
+    sourceHit: string | null;
+    sinkHit: string | null;
+    hasSource: boolean;
+    hasSink: boolean;
+}
+export interface TaintFunctionIndex {
+    fnByQual: Map<string, TaintFunctionNode>;
+    fnsByBareName: Map<string, TaintFunctionNode[]>;
+    totalCallSites: number;
+}
+export declare function buildTaintFunctionIndex(graph: CodeGraph, sources: Set<string>, sinks: Set<string>, customSources: Set<string>, customSinks: Set<string>): TaintFunctionIndex;

package/dist/core/taintIndex.js

@@ -0,0 +1,81 @@
+import { frameworkRequestSourceForFunction } from './frameworkSources.js';
+import { isDefaultChildProcessEnvPassthrough, pickSinkHit, pickSourceHit, } from './taintMatching.js';
+const EMPTY_STRING_ARRAY = [];
+export function buildTaintFunctionIndex(graph, sources, sinks, customSources, customSinks) {
+    const fnByQual = new Map();
+    const fnsByBareName = new Map();
+    let totalCallSites = 0;
+    for (const [file, graphFile] of graph.files) {
+        if (!graphFile.functions)
+            continue;
+        for (const fn of graphFile.functions) {
+            const node = buildTaintFunctionNode(file, graphFile, fn, sources, sinks, customSources, customSinks);
+            totalCallSites += node.callees.length;
+            fnByQual.set(node.id, node);
+            appendByBareName(fnsByBareName, node);
+        }
+    }
+    return { fnByQual, fnsByBareName, totalCallSites };
+}
+function buildTaintFunctionNode(file, graphFile, fn, sources, sinks, customSources, customSinks) {
+    const callees = optionalArray(fn.callSites);
+    const directCallSites = optionalArray(fn.directCallSites);
+    const memberCallSites = optionalArray(fn.memberCallSites);
+    const memberReferences = optionalArray(fn.memberReferences);
+    const memberAliases = optionalArray(fn.memberAliases);
+    const references = optionalArray(fn.references);
+    const sourceHit = resolveSourceHit(file, graphFile, fn, callees, directCallSites, memberCallSites, memberReferences, references, sources, customSources);
+    const sinkHit = resolveSinkHit(file, graphFile, callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks);
+    return {
+        id: `${file}::${fn.name}@${fn.line}`,
+        qualName: fn.name,
+        bareName: bareName(fn.name),
+        file,
+        callees,
+        references,
+        memberReferences,
+        sourceHit,
+        sinkHit,
+        hasSource: isActiveSourceHit(sourceHit, sinkHit, memberReferences, customSources, customSinks),
+        hasSink: sinkHit !== null,
+    };
+}
+function resolveSourceHit(file, graphFile, fn, callees, directCallSites, memberCallSites, memberReferences, references, sources, customSources) {
+    return (frameworkRequestSourceForFunction({
+        file,
+        functionName: fn.name,
+        memberCallSites,
+        memberReferences,
+        parameters: fn.parameters ?? [],
+        enabledSources: sources,
+        references,
+        contextualCallSite: fn.contextualCallSite,
+        imports: graphFile.imports,
+        directCallSites,
+    }) ?? pickSourceHit(callees, references, sources, customSources));
+}
+function resolveSinkHit(file, graphFile, callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks) {
+    return pickSinkHit(callees, directCallSites, memberCallSites, memberAliases, sinks, customSinks, file, graphFile);
+}
+function isActiveSourceHit(sourceHit, sinkHit, memberReferences, customSources, customSinks) {
+    return (sourceHit !== null &&
+        !isDefaultChildProcessEnvPassthrough(sourceHit, sinkHit, memberReferences, customSources, customSinks));
+}
+function appendByBareName(fnsByBareName, node) {
+    const existing = fnsByBareName.get(node.bareName);
+    if (existing) {
+        existing.push(node);
+        return;
+    }
+    fnsByBareName.set(node.bareName, [node]);
+}
+function optionalArray(values) {
+    return values ?? EMPTY_STRING_ARRAY;
+}
+function bareName(qualified) {
+    const dot = qualified.lastIndexOf('.');
+    if (dot < 0)
+        return qualified;
+    return qualified.slice(dot + 1);
+}
+//# sourceMappingURL=taintIndex.js.map

package/dist/core/taintIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taintIndex.js","sourceRoot":"","sources":["../../src/core/taintIndex.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,WAAW,EACX,aAAa,GACd,MAAM,oBAAoB,CAAC;AAuB5B,MAAM,kBAAkB,GAAa,EAAE,CAAC;AAExC,MAAM,UAAU,uBAAuB,CACrC,KAAgB,EAChB,OAAoB,EACpB,KAAkB,EAClB,aAA0B,EAC1B,WAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IACtD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC7D,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,sBAAsB,CACjC,IAAI,EACJ,SAAS,EACT,EAAE,EACF,OAAO,EACP,KAAK,EACL,aAAa,EACb,WAAW,CACZ,CAAC;YACF,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACtC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC5B,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAY,EACZ,SAAoB,EACpB,EAAiB,EACjB,OAAoB,EACpB,KAAkB,EAClB,aAA0B,EAC1B,WAAwB;IAExB,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,aAAa,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,aAAa,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,aAAa,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,aAAa,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,aAAa,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,gBAAgB,CAChC,IAAI,EACJ,SAAS,EACT,EAAE,EACF,OAAO,EACP,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,OAAO,EACP,aAAa,CACd,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAC5B,IAAI,EACJ,SAAS,EACT,OAAO,EACP,eAAe,EACf,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,CACZ,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,GAAG,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE;QACpC,QAAQ,EAAE,EAAE,CAAC,IAAI;QACjB,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC;QAC3B,IAAI;QACJ,OAAO;QACP,UAAU;QACV,gBAAgB;QAChB,SAAS;QACT,OAAO;QACP,SAAS,EAAE,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,CAAC;QAC9F,OAAO,EAAE,OAAO,KAAK,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAY,EACZ,SAAoB,EACpB,EAAiB,EACjB,OAAiB,EACjB,eAAyB,EACzB,eAAyB,EACzB,gBAA0B,EAC1B,UAAoB,EACpB,OAAoB,EACpB,aAA0B;IAE1B,OAAO,CACL,iCAAiC,CAAC;QAChC,IAAI;QACJ,YAAY,EAAE,EAAE,CAAC,IAAI;QACrB,eAAe;QACf,gBAAgB;QAChB,UAAU,EAAE,EAAE,CAAC,UAAU,IAAI,EAAE;QAC/B,cAAc,EAAE,OAAO;QACvB,UAAU;QACV,kBAAkB,EAAE,EAAE,CAAC,kBAAkB;QACzC,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,eAAe;KAChB,CAAC,IAAI,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CACjE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,SAAoB,EACpB,OAAiB,EACjB,eAAyB,EACzB,eAAyB,EACzB,aAAuB,EACvB,KAAkB,EAClB,WAAwB;IAExB,OAAO,WAAW,CAChB,OAAO,EACP,eAAe,EACf,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,EACX,IAAI,EACJ,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAwB,EACxB,OAAsB,EACtB,gBAA0B,EAC1B,aAA0B,EAC1B,WAAwB;IAExB,OAAO,CACL,SAAS,KAAK,IAAI;QAClB,CAAC,mCAAmC,CAClC,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,aAAa,EACb,WAAW,CACZ,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,aAA+C,EAC/C,IAAuB;IAEvB,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,MAA4B;IACjD,OAAO,MAAM,IAAI,kBAAkB,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/core/taintTraversal.d.ts

@@ -0,0 +1,8 @@
+import type { TaintFunctionIndex } from './taintIndex.js';
+import type { TaintFlow } from './taintTypes.js';
+export interface TaintTraversalResult {
+    flows: TaintFlow[];
+    truncatedSources: string[];
+    maxDepth: number;
+}
+export declare function findTaintFlows(index: TaintFunctionIndex): TaintTraversalResult;

package/dist/core/taintTraversal.js

@@ -0,0 +1,113 @@
+const MAX_DEPTH = 12;
+const MAX_FRONTIER_PER_STEP = 5000;
+export function findTaintFlows(index) {
+    const flows = [];
+    const seen = new Set();
+    const truncatedSources = [];
+    for (const sourceFn of index.fnByQual.values()) {
+        if (!sourceFn.hasSource)
+            continue;
+        recordSameFunctionFlow(sourceFn, flows, seen);
+        if (findFlowsFromSource(sourceFn, index, flows, seen)) {
+            truncatedSources.push(sourceFn.qualName);
+        }
+    }
+    sortTaintFlows(flows);
+    return {
+        flows,
+        truncatedSources: [...new Set(truncatedSources)].sort(),
+        maxDepth: MAX_DEPTH,
+    };
+}
+function recordSameFunctionFlow(sourceFn, flows, seen) {
+    if (!sourceFn.hasSink)
+        return;
+    const key = `${sourceFn.id}::${sourceFn.id}`;
+    if (seen.has(key))
+        return;
+    seen.add(key);
+    flows.push({
+        sourceFn: sourceFn.qualName,
+        sinkFn: sourceFn.qualName,
+        source: sourceFn.sourceHit,
+        sink: sourceFn.sinkHit,
+        path: [sourceFn.qualName],
+        files: [sourceFn.file],
+    });
+}
+function findFlowsFromSource(sourceFn, index, flows, seen) {
+    const visited = new Set([sourceFn.id]);
+    let frontier = [{ node: sourceFn, path: [sourceFn] }];
+    let depth = 0;
+    let frontierCapped = false;
+    while (frontier.length > 0 && depth < MAX_DEPTH) {
+        depth += 1;
+        const result = expandFrontier(sourceFn, frontier, index, visited, flows, seen);
+        frontier = result.next;
+        frontierCapped ||= result.frontierCapped;
+        if (result.frontierCapped)
+            break;
+    }
+    return frontier.length > 0 || frontierCapped;
+}
+function expandFrontier(sourceFn, frontier, index, visited, flows, seen) {
+    const next = [];
+    for (const entry of frontier) {
+        if (expandFrontierEntry(sourceFn, entry, index, visited, flows, seen, next)) {
+            return { next, frontierCapped: true };
+        }
+    }
+    return { next, frontierCapped: false };
+}
+function expandFrontierEntry(sourceFn, entry, index, visited, flows, seen, next) {
+    for (const calleeName of entry.node.callees) {
+        const candidates = index.fnsByBareName.get(calleeName) ?? [];
+        for (const candidate of candidates) {
+            if (addCandidate(sourceFn, entry, candidate, visited, flows, seen, next))
+                return true;
+        }
+    }
+    return false;
+}
+function addCandidate(sourceFn, entry, candidate, visited, flows, seen, next) {
+    if (visited.has(candidate.id))
+        return false;
+    visited.add(candidate.id);
+    const newPath = [...entry.path, candidate];
+    if (candidate.hasSink) {
+        recordPathFlow(sourceFn, candidate, newPath, flows, seen);
+        return false;
+    }
+    next.push({ node: candidate, path: newPath });
+    return next.length >= MAX_FRONTIER_PER_STEP;
+}
+function recordPathFlow(sourceFn, sinkFn, path, flows, seen) {
+    const flowKey = `${sourceFn.id}::${sinkFn.id}`;
+    if (seen.has(flowKey))
+        return;
+    seen.add(flowKey);
+    flows.push({
+        sourceFn: sourceFn.qualName,
+        sinkFn: sinkFn.qualName,
+        source: sourceFn.sourceHit,
+        sink: sinkFn.sinkHit,
+        path: path.map((node) => node.qualName),
+        files: filesInPath(path),
+    });
+}
+function filesInPath(path) {
+    const files = [];
+    for (const node of path) {
+        if (files[files.length - 1] !== node.file)
+            files.push(node.file);
+    }
+    return files;
+}
+function sortTaintFlows(flows) {
+    flows.sort((a, b) => {
+        if (a.sourceFn !== b.sourceFn)
+            return a.sourceFn.localeCompare(b.sourceFn);
+        return a.sinkFn.localeCompare(b.sinkFn);
+    });
+}
+//# sourceMappingURL=taintTraversal.js.map

package/dist/core/taintTraversal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taintTraversal.js","sourceRoot":"","sources":["../../src/core/taintTraversal.ts"],"names":[],"mappings":"AAGA,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAUnC,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,SAAS;QAClC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACtD,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAK,CAAC,CAAC;IACtB,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE;QACvD,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAA2B,EAC3B,KAAkB,EAClB,IAAiB;IAEjB,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO;IAC9B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ;QACzB,MAAM,EAAE,QAAQ,CAAC,SAAU;QAC3B,IAAI,EAAE,QAAQ,CAAC,OAAQ;QACvB,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,KAAK,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;KACvB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA2B,EAC3B,KAAyB,EACzB,KAAkB,EAClB,IAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,QAAQ,GAAoB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QAChD,KAAK,IAAI,CAAC,CAAC;QACX,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/E,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,cAAc,KAAK,MAAM,CAAC,cAAc,CAAC;QACzC,IAAI,MAAM,CAAC,cAAc;YAAE,MAAM;IACnC,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CACrB,QAA2B,EAC3B,QAAyB,EACzB,KAAyB,EACzB,OAAoB,EACpB,KAAkB,EAClB,IAAiB;IAEjB,MAAM,IAAI,GAAoB,EAAE,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5E,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA2B,EAC3B,KAAoB,EACpB,KAAyB,EACzB,OAAoB,EACpB,KAAkB,EAClB,IAAiB,EACjB,IAAqB;IAErB,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC7D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CACnB,QAA2B,EAC3B,KAAoB,EACpB,SAA4B,EAC5B,OAAoB,EACpB,KAAkB,EAClB,IAAiB,EACjB,IAAqB;IAErB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,MAAM,IAAI,qBAAqB,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CACrB,QAA2B,EAC3B,MAAyB,EACzB,IAAyB,EACzB,KAAkB,EAClB,IAAiB;IAEjB,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO;IAC9B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,MAAM,EAAE,QAAQ,CAAC,SAAU;QAC3B,IAAI,EAAE,MAAM,CAAC,OAAQ;QACrB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvC,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAyB;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAkB;IACxC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/taintTypes.d.ts

@@ -0,0 +1,67 @@
+export interface TaintConfig {
+    /**
+     * Bare callee names treated as taint sources. Examples:
+     *   "process.env"        - environment variables (read sensitive config)
+     *   "req.body"           - HTTP request body
+     *   "readFileSync"       - disk read (could be user-controlled paths)
+     *
+     * Match is by bare name (the rightmost identifier in a member-access
+     * chain). "process.env.SECRET" -> "env"; "req.body.userId" -> "body".
+     * The default list captures the most common JS / Python / Go sources;
+     * users override via .projscanrc taint.sources.
+     */
+    sources: string[];
+    /**
+     * Bare callee names treated as taint sinks. Examples:
+     *   "exec"               - child_process.exec
+     *   "spawn"              - child_process.spawn
+     *   "writeFile"          - fs.writeFile
+     *   "query"              - raw SQL (db.query("SELECT...${user}"))
+     *   "eval"               - JS eval / Python eval / etc.
+     */
+    sinks: string[];
+}
+export interface TaintFlow {
+    /** Bare function name where the source was called. */
+    sourceFn: string;
+    /** Bare function name where the sink was called. */
+    sinkFn: string;
+    /** The source identifier (e.g. "env"). */
+    source: string;
+    /** The sink identifier (e.g. "exec"). */
+    sink: string;
+    /**
+     * Sequence of fully-qualified function names from sourceFn to sinkFn,
+     * inclusive at both ends. Length 1 means the same function reads the
+     * source and calls the sink (the most direct flow).
+     */
+    path: string[];
+    /** Files touched by the path (in order, deduped). */
+    files: string[];
+}
+export interface TaintReport {
+    available: boolean;
+    reason?: string;
+    flowCount: number;
+    flows: TaintFlow[];
+    /** The effective sources/sinks list used for this run (after merging defaults + config). */
+    effectiveSources: string[];
+    effectiveSinks: string[];
+    /**
+     * 1.8+ - true when the BFS hit MAX_DEPTH for at least one source with
+     * a non-empty frontier still pending. When set, the agent should know
+     * that flows deeper than MAX_DEPTH may exist but weren't reported.
+     * Pairs with `truncatedSources` so a follow-up scan can re-target.
+     */
+    truncated?: boolean;
+    /**
+     * 1.8+ - function names whose BFS exited at MAX_DEPTH with the
+     * frontier non-empty. Empty when no truncation occurred.
+     */
+    truncatedSources?: string[];
+    /**
+     * 1.8+ - the depth cap actually used. Surfacing this lets agents
+     * notice when projscan's defaults shift between releases.
+     */
+    maxDepth?: number;
+}

package/dist/core/taintTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=taintTypes.js.map

package/dist/core/taintTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taintTypes.js","sourceRoot":"","sources":["../../src/core/taintTypes.ts"],"names":[],"mappings":""}