sdlc-agent-4-enterprise-server 1.0.0

package/dist/engine/analyzers/security/taint/TaintAnalyzer.js

@@ -0,0 +1,202 @@
+/**
+ * KSA-164: Taint Analyzer — Main taint analysis engine.
+ * Combines CFG, data flow, and taint propagation to find source-to-sink paths.
+ */
+import { CFGBuilder } from '../cfg/CFGBuilder.js';
+import { DataFlowAnalyzer } from '../dataflow/DataFlowAnalyzer.js';
+import { TaintRegistry } from './TaintRegistry.js';
+import { TaintPropagator } from './TaintPropagator.js';
+export class TaintAnalyzer {
+    cfgBuilder;
+    dataFlowAnalyzer;
+    registry;
+    propagator;
+    cfgCache = new Map();
+    MAX_CACHE = 100;
+    constructor(registry) {
+        this.cfgBuilder = new CFGBuilder();
+        this.dataFlowAnalyzer = new DataFlowAnalyzer();
+        this.registry = registry ?? new TaintRegistry();
+        this.propagator = new TaintPropagator(this.registry);
+    }
+    /** Perform taint analysis on a function node. */
+    analyze(functionNode, language, options = {}) {
+        const maxPathLength = options.maxPathLength ?? 20;
+        // Build CFG
+        const cfg = this.cfgBuilder.build(functionNode, language);
+        // Propagate taint through CFG blocks in topological order
+        const blockStates = new Map();
+        const initialState = new Map();
+        blockStates.set(cfg.entry.id, initialState);
+        // Identify sources from function parameters
+        this.identifyParamSources(functionNode, language, initialState);
+        // Forward propagation through CFG
+        for (const block of cfg.reversePostOrder()) {
+            // Merge predecessor states
+            const predecessors = cfg.getPredecessors(block);
+            let mergedState;
+            if (predecessors.length === 0) {
+                mergedState = new Map(blockStates.get(block.id) ?? initialState);
+            }
+            else {
+                mergedState = new Map();
+                for (const pred of predecessors) {
+                    const predState = blockStates.get(pred.id);
+                    if (predState) {
+                        for (const [key, val] of predState) {
+                            if (!mergedState.has(key))
+                                mergedState.set(key, val);
+                        }
+                    }
+                }
+            }
+            // Propagate through block
+            const outState = this.propagator.propagateBlock(block, mergedState);
+            blockStates.set(block.id, outState);
+        }
+        // Collect taint paths: find sinks that receive tainted data
+        const paths = [];
+        const sources = [];
+        const sinks = [];
+        for (const block of cfg.blocks) {
+            const state = blockStates.get(block.id);
+            if (!state)
+                continue;
+            for (const stmt of block.statements) {
+                const sinkInfo = this.findSink(stmt.node, state, language);
+                if (sinkInfo) {
+                    sinks.push(sinkInfo.sink);
+                    if (sinkInfo.taintState) {
+                        const path = {
+                            source: {
+                                variable: sinkInfo.taintState.variable,
+                                type: sinkInfo.taintState.sourceType,
+                                line: sinkInfo.taintState.sourceLine,
+                                expression: sinkInfo.taintState.variable,
+                            },
+                            sink: sinkInfo.sink,
+                            chain: sinkInfo.taintState.steps.slice(0, maxPathLength),
+                            sanitized: false,
+                            length: sinkInfo.taintState.steps.length,
+                        };
+                        paths.push(path);
+                        // Track unique sources
+                        if (!sources.find(s => s.variable === path.source.variable && s.line === path.source.line)) {
+                            sources.push(path.source);
+                        }
+                    }
+                }
+            }
+        }
+        // Filter by options
+        let filteredPaths = paths;
+        if (options.sinkTypes) {
+            filteredPaths = filteredPaths.filter(p => options.sinkTypes.includes(p.sink.type));
+        }
+        if (options.sourceTypes) {
+            filteredPaths = filteredPaths.filter(p => options.sourceTypes.includes(p.source.type));
+        }
+        if (!options.includeSanitized) {
+            filteredPaths = filteredPaths.filter(p => !p.sanitized);
+        }
+        return {
+            paths: filteredPaths,
+            sources,
+            sinks,
+            sanitizers: [],
+        };
+    }
+    /** Get the taint registry for external configuration. */
+    getRegistry() {
+        return this.registry;
+    }
+    /** Identify taint sources from function parameters. */
+    identifyParamSources(functionNode, language, state) {
+        const params = functionNode.childForFieldName('parameters');
+        if (!params)
+            return;
+        for (let i = 0; i < params.namedChildCount; i++) {
+            const param = params.namedChild(i);
+            if (!param)
+                continue;
+            let paramName = null;
+            if (param.type === 'identifier') {
+                paramName = param.text;
+            }
+            else if (param.type === 'required_parameter' || param.type === 'optional_parameter') {
+                const nameNode = param.childForFieldName('pattern') ?? param.childForFieldName('name');
+                if (nameNode)
+                    paramName = nameNode.text;
+            }
+            else if (param.type === 'formal_parameters') {
+                continue;
+            }
+            if (!paramName)
+                continue;
+            // Common HTTP handler parameter names
+            const httpParams = ['req', 'request', 'ctx', 'context'];
+            if (httpParams.includes(paramName)) {
+                state.set(paramName, {
+                    variable: paramName,
+                    tainted: true,
+                    sourceType: 'http_param',
+                    sourceLine: param.startPosition.row + 1,
+                    steps: [],
+                });
+            }
+        }
+    }
+    /** Find a taint sink in a statement and check if it receives tainted data. */
+    findSink(node, state, language) {
+        if (node.type === 'call_expression' || node.type === 'expression_statement') {
+            const callNode = node.type === 'expression_statement' ? node.namedChild(0) : node;
+            if (!callNode || callNode.type !== 'call_expression')
+                return null;
+            const fn = callNode.childForFieldName('function');
+            if (!fn)
+                return null;
+            const sinkMatch = this.registry.matchSink(fn.text, language);
+            if (!sinkMatch)
+                return null;
+            const sink = {
+                function: fn.text,
+                type: sinkMatch.type,
+                line: callNode.startPosition.row + 1,
+                expression: callNode.text.slice(0, 100),
+                paramIndex: sinkMatch.paramIndex,
+            };
+            // Check if the relevant argument is tainted
+            const args = callNode.childForFieldName('arguments');
+            if (args) {
+                const targetArg = args.namedChild(sinkMatch.paramIndex);
+                if (targetArg) {
+                    const taintInfo = this.propagator.evaluateExpression(targetArg, state);
+                    if (taintInfo.tainted) {
+                        return {
+                            sink,
+                            taintState: {
+                                variable: targetArg.text.slice(0, 50),
+                                tainted: true,
+                                sourceType: taintInfo.sourceType,
+                                sourceLine: taintInfo.sourceLine,
+                                steps: taintInfo.steps,
+                            },
+                        };
+                    }
+                }
+            }
+            return { sink, taintState: null };
+        }
+        // Recurse into child expressions
+        for (let i = 0; i < node.namedChildCount; i++) {
+            const child = node.namedChild(i);
+            if (child) {
+                const result = this.findSink(child, state, language);
+                if (result?.taintState)
+                    return result;
+            }
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=TaintAnalyzer.js.map

package/dist/engine/analyzers/security/taint/TaintAnalyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaintAnalyzer.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/taint/TaintAnalyzer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAmB,MAAM,sBAAsB,CAAC;AAIxE,MAAM,OAAO,aAAa;IAChB,UAAU,CAAa;IACvB,gBAAgB,CAAmB;IACnC,QAAQ,CAAgB;IACxB,UAAU,CAAkB;IAC5B,QAAQ,GAAkC,IAAI,GAAG,EAAE,CAAC;IAC3C,SAAS,GAAG,GAAG,CAAC;IAEjC,YAAY,QAAwB;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,aAAa,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,iDAAiD;IACjD,OAAO,CAAC,YAAwB,EAAE,QAAgB,EAAE,UAAwB,EAAE;QAC5E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QAElD,YAAY;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAE1D,0DAA0D;QAC1D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;QAC/D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;QACnD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAE5C,4CAA4C;QAC5C,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAEhE,kCAAkC;QAClC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC3C,2BAA2B;YAC3B,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,WAAoC,CAAC;YAEzC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;gBAC5C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC3C,IAAI,SAAS,EAAE,CAAC;wBACd,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;4BACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;gCAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;wBACvD,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACpE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC;QAED,4DAA4D;QAC5D,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;QAE9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC3D,IAAI,QAAQ,EAAE,CAAC;oBACb,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC1B,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;wBACxB,MAAM,IAAI,GAAc;4BACtB,MAAM,EAAE;gCACN,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ;gCACtC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAiC;gCAC3D,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;gCACpC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,QAAQ;6BACzC;4BACD,IAAI,EAAE,QAAQ,CAAC,IAAI;4BACnB,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;4BACxD,SAAS,EAAE,KAAK;4BAChB,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM;yBACzC,CAAC;wBACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAEjB,uBAAuB;wBACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC3F,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC5B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,SAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,WAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC9B,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO;YACP,KAAK;YACL,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,uDAAuD;IAC/C,oBAAoB,CAC1B,YAAwB,EACxB,QAAgB,EAChB,KAA8B;QAE9B,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,IAAI,SAAS,GAAkB,IAAI,CAAC;YAEpC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;YACzB,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBACtF,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACvF,IAAI,QAAQ;oBAAE,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC1C,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC9C,SAAS;YACX,CAAC;YAED,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,sCAAsC;YACtC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE;oBACnB,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,YAAY;oBACxB,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBACvC,KAAK,EAAE,EAAE;iBACV,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IACtE,QAAQ,CACd,IAAgB,EAChB,KAA8B,EAC9B,QAAgB;QAEhB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YAElE,MAAM,EAAE,GAAG,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAErB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC7D,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAE5B,MAAM,IAAI,GAAc;gBACtB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gBACpC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvC,UAAU,EAAE,SAAS,CAAC,UAAU;aACjC,CAAC;YAEF,4CAA4C;YAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBACxD,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;oBACvE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;wBACtB,OAAO;4BACL,IAAI;4BACJ,UAAU,EAAE;gCACV,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gCACrC,OAAO,EAAE,IAAI;gCACb,UAAU,EAAE,SAAS,CAAC,UAAU;gCAChC,UAAU,EAAE,SAAS,CAAC,UAAU;gCAChC,KAAK,EAAE,SAAS,CAAC,KAAK;6BACvB;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,iCAAiC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBACrD,IAAI,MAAM,EAAE,UAAU;oBAAE,OAAO,MAAM,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/engine/analyzers/security/taint/TaintPropagator.d.ts

@@ -0,0 +1,35 @@
+/**
+ * KSA-164: Taint Propagator — Propagates taint state through CFG blocks.
+ */
+import type { SyntaxNode } from '../../../parsers/types.js';
+import type { BasicBlock } from '../cfg/BasicBlock.js';
+import type { TaintStep } from '../types.js';
+import { TaintRegistry } from './TaintRegistry.js';
+export interface TaintState {
+    variable: string;
+    tainted: boolean;
+    sourceType: string;
+    sourceLine: number;
+    steps: TaintStep[];
+}
+export declare class TaintPropagator {
+    private registry;
+    constructor(registry: TaintRegistry);
+    /** Propagate taint through a single block, updating state map. */
+    propagateBlock(block: BasicBlock, state: Map<string, TaintState>): Map<string, TaintState>;
+    /** Propagate taint for a single statement. */
+    private propagateStatement;
+    private handleDeclaration;
+    private handleAssignment;
+    private propagateExpression;
+    /** Evaluate if an expression produces a tainted value. */
+    evaluateExpression(node: SyntaxNode, state: Map<string, TaintState>): {
+        tainted: boolean;
+        sourceType: string;
+        sourceLine: number;
+        steps: TaintStep[];
+        action: TaintStep['action'];
+    };
+    /** Check if a call expression is a sanitizer. */
+    private isSanitizerCall;
+}

package/dist/engine/analyzers/security/taint/TaintPropagator.js

@@ -0,0 +1,223 @@
+/**
+ * KSA-164: Taint Propagator — Propagates taint state through CFG blocks.
+ */
+export class TaintPropagator {
+    registry;
+    constructor(registry) {
+        this.registry = registry;
+    }
+    /** Propagate taint through a single block, updating state map. */
+    propagateBlock(block, state) {
+        const newState = new Map(state);
+        for (const stmt of block.statements) {
+            this.propagateStatement(stmt.node, newState);
+        }
+        return newState;
+    }
+    /** Propagate taint for a single statement. */
+    propagateStatement(node, state) {
+        const type = node.type;
+        // Handle variable declarations and assignments
+        if (type === 'lexical_declaration' || type === 'variable_declaration') {
+            this.handleDeclaration(node, state);
+        }
+        else if (type === 'expression_statement') {
+            const expr = node.namedChild(0);
+            if (expr)
+                this.propagateExpression(expr, state);
+        }
+        else if (type === 'assignment_expression' || type === 'augmented_assignment_expression') {
+            this.handleAssignment(node, state);
+        }
+    }
+    handleDeclaration(node, state) {
+        for (let i = 0; i < node.namedChildCount; i++) {
+            const declarator = node.namedChild(i);
+            if (!declarator || declarator.type !== 'variable_declarator')
+                continue;
+            const nameNode = declarator.childForFieldName('name');
+            const valueNode = declarator.childForFieldName('value');
+            if (!nameNode || !valueNode)
+                continue;
+            const varName = nameNode.text;
+            const taintInfo = this.evaluateExpression(valueNode, state);
+            if (taintInfo.tainted) {
+                state.set(varName, {
+                    variable: varName,
+                    tainted: true,
+                    sourceType: taintInfo.sourceType,
+                    sourceLine: taintInfo.sourceLine,
+                    steps: [...taintInfo.steps, {
+                            variable: varName,
+                            line: nameNode.startPosition.row + 1,
+                            action: taintInfo.action,
+                            expression: valueNode.text.slice(0, 80),
+                        }],
+                });
+            }
+            else {
+                // Check if this is a sanitizer call
+                if (this.isSanitizerCall(valueNode)) {
+                    state.delete(varName);
+                }
+                else {
+                    state.delete(varName);
+                }
+            }
+        }
+    }
+    handleAssignment(node, state) {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (!left || !right)
+            return;
+        if (left.type !== 'identifier')
+            return;
+        const varName = left.text;
+        const taintInfo = this.evaluateExpression(right, state);
+        if (taintInfo.tainted) {
+            state.set(varName, {
+                variable: varName,
+                tainted: true,
+                sourceType: taintInfo.sourceType,
+                sourceLine: taintInfo.sourceLine,
+                steps: [...taintInfo.steps, {
+                        variable: varName,
+                        line: left.startPosition.row + 1,
+                        action: taintInfo.action,
+                        expression: right.text.slice(0, 80),
+                    }],
+            });
+        }
+        else {
+            state.delete(varName);
+        }
+    }
+    propagateExpression(node, state) {
+        if (node.type === 'assignment_expression' || node.type === 'augmented_assignment_expression') {
+            this.handleAssignment(node, state);
+        }
+    }
+    /** Evaluate if an expression produces a tainted value. */
+    evaluateExpression(node, state) {
+        const notTainted = { tainted: false, sourceType: '', sourceLine: 0, steps: [], action: 'assign' };
+        // Direct identifier reference
+        if (node.type === 'identifier') {
+            const existing = state.get(node.text);
+            if (existing?.tainted) {
+                return { tainted: true, sourceType: existing.sourceType, sourceLine: existing.sourceLine, steps: existing.steps, action: 'pass_through' };
+            }
+            return notTainted;
+        }
+        // Member expression (e.g., req.body.name)
+        if (node.type === 'member_expression') {
+            const text = node.text;
+            const sourceMatch = this.registry.matchSource(text);
+            if (sourceMatch) {
+                return { tainted: true, sourceType: sourceMatch.type, sourceLine: node.startPosition.row + 1, steps: [], action: 'assign' };
+            }
+            // Check if object is tainted
+            const obj = node.childForFieldName('object');
+            if (obj) {
+                const objTaint = this.evaluateExpression(obj, state);
+                if (objTaint.tainted)
+                    return { ...objTaint, action: 'pass_through' };
+            }
+            return notTainted;
+        }
+        // Call expression
+        if (node.type === 'call_expression') {
+            const fn = node.childForFieldName('function');
+            if (fn) {
+                // Check if it's a sanitizer
+                if (this.isSanitizerCall(node)) {
+                    return notTainted;
+                }
+                // Check if it's a source
+                const sourceMatch = this.registry.matchSource(fn.text);
+                if (sourceMatch) {
+                    return { tainted: true, sourceType: sourceMatch.type, sourceLine: node.startPosition.row + 1, steps: [], action: 'function_call' };
+                }
+                // Check if arguments are tainted (conservative: if any arg tainted, result tainted)
+                const args = node.childForFieldName('arguments');
+                if (args) {
+                    for (let i = 0; i < args.namedChildCount; i++) {
+                        const arg = args.namedChild(i);
+                        if (arg) {
+                            const argTaint = this.evaluateExpression(arg, state);
+                            if (argTaint.tainted) {
+                                return { ...argTaint, action: 'function_call' };
+                            }
+                        }
+                    }
+                }
+            }
+            return notTainted;
+        }
+        // Template literal (template_string)
+        if (node.type === 'template_string') {
+            for (let i = 0; i < node.namedChildCount; i++) {
+                const child = node.namedChild(i);
+                if (child && child.type === 'template_substitution') {
+                    const expr = child.namedChild(0);
+                    if (expr) {
+                        const exprTaint = this.evaluateExpression(expr, state);
+                        if (exprTaint.tainted) {
+                            return { ...exprTaint, action: 'template_literal' };
+                        }
+                    }
+                }
+            }
+            return notTainted;
+        }
+        // Binary expression (string concatenation)
+        if (node.type === 'binary_expression') {
+            const left = node.childForFieldName('left');
+            const right = node.childForFieldName('right');
+            if (left) {
+                const leftTaint = this.evaluateExpression(left, state);
+                if (leftTaint.tainted)
+                    return { ...leftTaint, action: 'concat' };
+            }
+            if (right) {
+                const rightTaint = this.evaluateExpression(right, state);
+                if (rightTaint.tainted)
+                    return { ...rightTaint, action: 'concat' };
+            }
+            return notTainted;
+        }
+        // Subscript/element access
+        if (node.type === 'subscript_expression') {
+            const obj = node.childForFieldName('object');
+            if (obj) {
+                const objTaint = this.evaluateExpression(obj, state);
+                if (objTaint.tainted)
+                    return { ...objTaint, action: 'pass_through' };
+            }
+            return notTainted;
+        }
+        // Await expression
+        if (node.type === 'await_expression') {
+            const child = node.namedChild(0);
+            if (child)
+                return this.evaluateExpression(child, state);
+            return notTainted;
+        }
+        return notTainted;
+    }
+    /** Check if a call expression is a sanitizer. */
+    isSanitizerCall(node) {
+        const fn = node.type === 'call_expression' ? node.childForFieldName('function') : null;
+        if (!fn)
+            return false;
+        const fnText = fn.text;
+        // Check against all sink types
+        const sinkTypes = ['sql_query', 'shell_exec', 'html_output', 'file_path', 'url_fetch'];
+        for (const sinkType of sinkTypes) {
+            if (this.registry.isSanitizer(fnText, sinkType))
+                return true;
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=TaintPropagator.js.map

package/dist/engine/analyzers/security/taint/TaintPropagator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TaintPropagator.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/taint/TaintPropagator.ts"],"names":[],"mappings":"AAAA;;GAEG;AAeH,MAAM,OAAO,eAAe;IAClB,QAAQ,CAAgB;IAEhC,YAAY,QAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,kEAAkE;IAClE,cAAc,CAAC,KAAiB,EAAE,KAA8B;QAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,8CAA8C;IACtC,kBAAkB,CAAC,IAAgB,EAAE,KAA8B;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,+CAA+C;QAC/C,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACtE,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI;gBAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC1F,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,IAAgB,EAAE,KAA8B;QACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB;gBAAE,SAAS;YAEvE,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAE5D,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;gBACtB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;oBACjB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE;4BAC1B,QAAQ,EAAE,OAAO;4BACjB,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;4BACpC,MAAM,EAAE,SAAS,CAAC,MAAM;4BACxB,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;yBACxC,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,oCAAoC;gBACpC,IAAI,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;oBACpC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,IAAgB,EAAE,KAA8B;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAE5B,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;gBACjB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE;wBAC1B,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;wBAChC,MAAM,EAAE,SAAS,CAAC,MAAM;wBACxB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;qBACpC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,mBAAmB,CAAC,IAAgB,EAAE,KAA8B;QAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,IAAI,IAAI,CAAC,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC7F,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,kBAAkB,CAAC,IAAgB,EAAE,KAA8B;QAOjE,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC;QAE3G,8BAA8B;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;gBACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAC5I,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,0CAA0C;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC9H,CAAC;YACD,6BAA6B;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACrD,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACvE,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,kBAAkB;QAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,EAAE,EAAE,CAAC;gBACP,4BAA4B;gBAC5B,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,OAAO,UAAU,CAAC;gBACpB,CAAC;gBACD,yBAAyB;gBACzB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBACvD,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBACrI,CAAC;gBACD,oFAAoF;gBACpF,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBACjD,IAAI,IAAI,EAAE,CAAC;oBACT,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;wBAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;wBAC/B,IAAI,GAAG,EAAE,CAAC;4BACR,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;4BACrD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gCACrB,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;4BAClD,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;oBACpD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBACjC,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBACvD,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;4BACtB,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;wBACtD,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,SAAS,CAAC,OAAO;oBAAE,OAAO,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACzD,IAAI,UAAU,CAAC,OAAO;oBAAE,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACrE,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,2BAA2B;QAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACrD,IAAI,QAAQ,CAAC,OAAO;oBAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACvE,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,KAAK;gBAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,iDAAiD;IACzC,eAAe,CAAC,IAAgB;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACtB,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC;QAEvB,+BAA+B;QAC/B,MAAM,SAAS,GAAoB,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QACxG,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/engine/analyzers/security/taint/TaintRegistry.d.ts

@@ -0,0 +1,47 @@
+/**
+ * KSA-164: Taint Registry — Configuration of taint sources, sinks, and sanitizers.
+ */
+import type { TaintSourceType, TaintSinkType } from '../types.js';
+export interface SourcePattern {
+    type: TaintSourceType;
+    patterns: string[];
+    language?: string;
+}
+export interface SinkPattern {
+    type: TaintSinkType;
+    functions: string[];
+    paramIndex: number;
+    language?: string;
+}
+export interface SanitizerPattern {
+    function: string;
+    sanitizes: TaintSinkType[];
+    language?: string;
+}
+export declare class TaintRegistry {
+    private sources;
+    private sinks;
+    private sanitizers;
+    constructor();
+    /** Check if an expression matches a taint source pattern. */
+    matchSource(expression: string, language?: string): {
+        type: TaintSourceType;
+    } | null;
+    /** Check if a function call matches a taint sink. */
+    matchSink(functionName: string, language?: string): SinkPattern | null;
+    /** Check if a function is a sanitizer for a given sink type. */
+    isSanitizer(functionName: string, sinkType: TaintSinkType, language?: string): boolean;
+    /** Get all registered source types. */
+    getSources(): SourcePattern[];
+    /** Get all registered sink types. */
+    getSinks(): SinkPattern[];
+    /** Get all registered sanitizers. */
+    getSanitizers(): SanitizerPattern[];
+    /** Add custom source pattern. */
+    addSource(source: SourcePattern): void;
+    /** Add custom sink pattern. */
+    addSink(sink: SinkPattern): void;
+    /** Add custom sanitizer. */
+    addSanitizer(sanitizer: SanitizerPattern): void;
+    private loadDefaults;
+}

package/dist/engine/analyzers/security/taint/TaintRegistry.js

@@ -0,0 +1,109 @@
+/**
+ * KSA-164: Taint Registry — Configuration of taint sources, sinks, and sanitizers.
+ */
+export class TaintRegistry {
+    sources = [];
+    sinks = [];
+    sanitizers = [];
+    constructor() {
+        this.loadDefaults();
+    }
+    /** Check if an expression matches a taint source pattern. */
+    matchSource(expression, language) {
+        for (const source of this.sources) {
+            if (source.language && language && source.language !== language)
+                continue;
+            for (const pattern of source.patterns) {
+                if (expression.includes(pattern)) {
+                    return { type: source.type };
+                }
+            }
+        }
+        return null;
+    }
+    /** Check if a function call matches a taint sink. */
+    matchSink(functionName, language) {
+        for (const sink of this.sinks) {
+            if (sink.language && language && sink.language !== language)
+                continue;
+            for (const fn of sink.functions) {
+                if (functionName.includes(fn))
+                    return sink;
+            }
+        }
+        return null;
+    }
+    /** Check if a function is a sanitizer for a given sink type. */
+    isSanitizer(functionName, sinkType, language) {
+        for (const san of this.sanitizers) {
+            if (san.language && language && san.language !== language)
+                continue;
+            if (functionName.includes(san.function) && san.sanitizes.includes(sinkType)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** Get all registered source types. */
+    getSources() { return this.sources; }
+    /** Get all registered sink types. */
+    getSinks() { return this.sinks; }
+    /** Get all registered sanitizers. */
+    getSanitizers() { return this.sanitizers; }
+    /** Add custom source pattern. */
+    addSource(source) { this.sources.push(source); }
+    /** Add custom sink pattern. */
+    addSink(sink) { this.sinks.push(sink); }
+    /** Add custom sanitizer. */
+    addSanitizer(sanitizer) { this.sanitizers.push(sanitizer); }
+    loadDefaults() {
+        // HTTP sources (common across frameworks)
+        this.sources = [
+            { type: 'http_param', patterns: ['req.query', 'req.params', 'request.args', 'request.GET', 'request.POST', 'ctx.query', 'ctx.params'] },
+            { type: 'http_body', patterns: ['req.body', 'request.json', 'request.form', 'request.data', 'ctx.request.body'] },
+            { type: 'http_header', patterns: ['req.headers', 'req.get(', 'request.headers', 'ctx.headers'] },
+            { type: 'http_cookie', patterns: ['req.cookies', 'request.cookies', 'ctx.cookies'] },
+            { type: 'url_param', patterns: ['req.url', 'req.originalUrl', 'request.url', 'window.location'] },
+            { type: 'file_read', patterns: ['fs.readFile', 'readFileSync', 'open(', 'fread'] },
+            { type: 'env_var', patterns: ['process.env', 'os.environ', 'getenv'] },
+            { type: 'user_input', patterns: ['prompt(', 'readline', 'input(', 'stdin'] },
+            { type: 'cli_arg', patterns: ['process.argv', 'sys.argv', 'args['] },
+            { type: 'db_result', patterns: ['.query(', '.findOne(', '.find(', '.execute('] },
+            { type: 'websocket', patterns: ['ws.on(', 'socket.on(', 'message.data'] },
+        ];
+        // Sinks
+        this.sinks = [
+            { type: 'sql_query', functions: ['query(', 'execute(', 'raw(', 'sequelize.query', 'knex.raw', 'db.run(', 'cursor.execute'], paramIndex: 0 },
+            { type: 'shell_exec', functions: ['exec(', 'execSync(', 'spawn(', 'system(', 'popen(', 'subprocess.run', 'child_process'], paramIndex: 0 },
+            { type: 'file_write', functions: ['writeFile(', 'writeFileSync(', 'createWriteStream(', 'fwrite'], paramIndex: 1 },
+            { type: 'file_path', functions: ['readFile(', 'readFileSync(', 'open(', 'path.join(', 'path.resolve('], paramIndex: 0 },
+            { type: 'html_output', functions: ['innerHTML', 'outerHTML', 'document.write(', 'res.send(', 'render(', 'dangerouslySetInnerHTML'], paramIndex: 0 },
+            { type: 'eval', functions: ['eval(', 'Function(', 'setTimeout(', 'setInterval(', 'vm.runInContext'], paramIndex: 0 },
+            { type: 'deserialize', functions: ['unserialize(', 'pickle.loads(', 'yaml.load(', 'JSON.parse('], paramIndex: 0 },
+            { type: 'ldap_query', functions: ['ldap.search(', 'ldap.bind(', 'ldapjs.search'], paramIndex: 0 },
+            { type: 'xml_parse', functions: ['parseXML(', 'DOMParser', 'xml2js.parse', 'libxml.parse', 'etree.fromstring'], paramIndex: 0 },
+            { type: 'url_fetch', functions: ['fetch(', 'axios(', 'axios.get(', 'axios.post(', 'http.get(', 'request(', 'urllib.request', 'requests.get'], paramIndex: 0 },
+            { type: 'redirect', functions: ['res.redirect(', 'response.redirect(', 'window.location', 'location.href'], paramIndex: 0 },
+            { type: 'log_output', functions: ['console.log(', 'logger.info(', 'logger.error(', 'logging.info'], paramIndex: 0 },
+        ];
+        // Sanitizers
+        this.sanitizers = [
+            { function: 'escape', sanitizes: ['html_output', 'sql_query'] },
+            { function: 'sanitize', sanitizes: ['html_output', 'sql_query', 'shell_exec'] },
+            { function: 'encodeURI', sanitizes: ['url_fetch', 'redirect'] },
+            { function: 'encodeURIComponent', sanitizes: ['url_fetch', 'redirect', 'html_output'] },
+            { function: 'parseInt', sanitizes: ['sql_query', 'shell_exec', 'file_path'] },
+            { function: 'Number(', sanitizes: ['sql_query', 'shell_exec'] },
+            { function: 'validator.', sanitizes: ['sql_query', 'html_output', 'shell_exec'] },
+            { function: 'DOMPurify', sanitizes: ['html_output'] },
+            { function: 'xss(', sanitizes: ['html_output'] },
+            { function: 'sqlstring.escape', sanitizes: ['sql_query'] },
+            { function: 'parameterize', sanitizes: ['sql_query'] },
+            { function: 'shellescape', sanitizes: ['shell_exec'] },
+            { function: 'path.basename', sanitizes: ['file_path'] },
+            { function: 'path.normalize', sanitizes: ['file_path'] },
+            { function: 'new URL(', sanitizes: ['url_fetch', 'redirect'] },
+        ];
+    }
+}
+//# sourceMappingURL=TaintRegistry.js.map