apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/data_flow.py

@@ -0,0 +1,1883 @@
+"""
+Inter-procedural data flow (taint) tracking.
+
+This module implements taint analysis to track how data flows from HTTP inputs
+(sources) through the program to function calls (potential sinks). The probe
+does NOT decide what constitutes a vulnerability - it only tracks data flow
+paths. The cloud service applies sink/source rules to identify issues.
+
+Key concepts:
+- **Origin**: Where data enters (HTTP params, body, headers, etc.)
+- **Taint**: A marker indicating data came from an origin
+- **Propagation**: How taint spreads through assignments and calls
+- **Path**: The sequence of function calls data flows through
+- **Sink**: Any function call that receives tainted data (cloud decides danger)
+
+Algorithm:
+1. Identify all data origins from route handlers (entry points)
+2. Mark function parameters that receive origin data as tainted
+3. Propagate taint through:
+   - Assignments: x = y spreads taint from y to x
+   - Returns: return tainted_var taints the call result
+   - Arguments: func(tainted) taints the parameter in callee
+4. Record the full path when tainted data reaches a function call
+5. Track transformations (string operations, encoding, etc.)
+
+Depth limit: We stop propagation at a configurable max depth (default 10)
+to prevent infinite recursion and manage memory.
+"""
+
+from __future__ import annotations
+
+import logging
+from collections import defaultdict
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+from ..core.manifest import stable_id
+from ..core.types import OriginType
+
+if TYPE_CHECKING:
+    from ..parsing.base import ParsedCallSite, ParsedFile, ParsedFunction
+    from .call_graph import CallGraph, CallGraphEdge
+    from .flow_analysis import FlowSensitiveBindings
+
+
+logger = logging.getLogger(__name__)
+
+
+# =============================================================================
+# Core Data Structures
+# =============================================================================
+
+
+@dataclass
+class TaintedValue:
+    """
+    Represents a tainted value being tracked.
+
+    A taint propagates from an origin and carries information about
+    where the data came from and how it was transformed.
+    """
+
+    # Unique ID for this taint instance
+    taint_id: str
+
+    # Origin information
+    origin_type: OriginType
+    origin_name: str  # Parameter name, header name, etc.
+    origin_location: tuple[Path, int]  # (file, line)
+    entry_point_id: str | None  # Reference to entry point (route)
+
+    # Current state
+    current_variable: str  # Variable name holding tainted data
+    current_function: str  # Function where taint currently is
+    current_file: Path
+
+    # Path tracking
+    depth: int = 0
+    path: list[FlowStep] = field(default_factory=list)
+
+    # Transformations applied
+    transformations: list[Transformation] = field(default_factory=list)
+
+    # Metadata
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class FlowStep:
+    """A step in the data flow path."""
+
+    depth: int
+    caller: str  # Calling function
+    callee: str  # Called function
+    argument_index: int | None  # Which argument carried the taint
+    argument_name: str | None  # Parameter name in callee
+    location: tuple[Path, int]  # (file, line)
+
+    # Mapping: how caller's variable maps to callee's parameter
+    variable_mapping: dict[str, str] = field(default_factory=dict)
+
+
+class TransformationType:
+    """Well-known transformation type constants (cloud-interpretable)."""
+
+    FUNCTION_CALL = "function_call"  # x = func(y)
+    METHOD_CALL = "method_call"  # x = y.method()
+    STRING_FORMAT = "string_format"  # x = f"...{y}..."
+    BINARY_OP = "binary_op"  # x = y + z
+    TYPE_CONSTRUCTOR = "type_constructor"  # x = int(y), x = str(y)
+    ATTRIBUTE_ACCESS = "attribute_access"  # x = y.attr
+
+
+@dataclass
+class Transformation:
+    """A transformation applied to tainted data."""
+
+    type: str  # See TransformationType constants
+    description: str | None
+    location: tuple[Path, int]
+    function: str | None  # Function / method that performed the transform
+
+    # The depth in the inter-procedural path where this transformation occurs.
+    # -1 means intra-procedural (within the same function as the source).
+    depth: int = -1
+
+    # Structural evidence about the transformation call site (co-arguments, kwargs).
+    call_evidence: Any = None  # CallSiteEvidence from sink_evidence module
+
+
+@dataclass
+class DataFlow:
+    """
+    A complete data flow from origin to a function call.
+
+    This is the output of taint analysis - one flow per origin-to-call path.
+    """
+
+    id: str  # Unique ID (flow-001, etc.)
+
+    # Origin (source)
+    origin_type: OriginType
+    origin_name: str
+    origin_location: tuple[Path, int]
+    entry_point_id: str | None
+
+    # Sink (destination function call)
+    sink_function: str  # Qualified name of called function
+    sink_argument_index: int | None
+    sink_argument_name: str | None
+    sink_location: tuple[Path, int]
+    sink_call_id: str | None  # Reference to call in call graph
+
+    # Path through code
+    path: list[FlowStep]
+    depth: int
+    truncated: bool = False  # True if cut off at max depth
+
+    # Transformations
+    transformations: list[Transformation] = field(default_factory=list)
+
+    # Sink evidence (structural facts about the call site)
+    sink_evidence: Any = None  # CallSiteEvidence from sink_evidence module
+
+    # Context at sink
+    sink_context: dict[str, Any] = field(default_factory=dict)
+
+    # Confidence
+    confidence: str = "HIGH"  # HIGH, MEDIUM, LOW
+
+
+# =============================================================================
+# Taint Propagator
+# =============================================================================
+
+
+class TaintPropagator:
+    """
+    Propagates taint through the program using the call graph.
+
+    This is the core engine that tracks how data flows through function
+    calls. It uses the call graph for inter-procedural tracking and
+    flow-sensitive bindings for intra-procedural tracking.
+
+    Uses actual call-site argument analysis when parsed_files are provided
+    for accurate taint propagation (which variable flows to which parameter).
+    """
+
+    def __init__(
+        self,
+        call_graph: CallGraph,
+        flow_bindings: FlowSensitiveBindings | None = None,
+        max_depth: int = 10,
+        parsed_files: list[ParsedFile] | None = None,
+    ):
+        self._call_graph = call_graph
+        self._flow_bindings = flow_bindings
+        self._max_depth = max_depth
+        self._parsed_files = {pf.path: pf for pf in (parsed_files or []) if pf.success}
+
+        # Taint state: function -> variable -> set of taints
+        self._taints: dict[str, dict[str, set[str]]] = defaultdict(lambda: defaultdict(set))
+
+        # Active taints being propagated
+        self._active_taints: dict[str, TaintedValue] = {}
+
+        # Completed flows
+        self._flows: list[DataFlow] = []
+
+        # Next IDs (taint IDs are internal-only, stay sequential)
+        self._next_taint_id = 0
+
+        # Visited states (to prevent infinite loops)
+        self._visited: set[tuple[str, str, int]] = set()
+
+        # Statistics
+        self._stats = {
+            "taints_created": 0,
+            "flows_found": 0,
+            "max_depth_reached": 0,
+            "cycles_avoided": 0,
+        }
+
+    def add_origin(
+        self,
+        origin_type: OriginType,
+        origin_name: str,
+        origin_location: tuple[Path, int],
+        entry_point_id: str | None,
+        function_qname: str,
+        parameter_name: str,
+    ) -> str:
+        """
+        Add a new data origin to track.
+
+        This creates a taint that will be propagated through the code.
+
+        Args:
+            origin_type: Type of origin (HTTP_PATH_PARAM, etc.)
+            origin_name: Name of the origin (parameter name, header name, etc.)
+            origin_location: Where the origin is in code
+            entry_point_id: Reference to the entry point (route)
+            function_qname: Function where the origin enters
+            parameter_name: Parameter that receives the origin data
+
+        Returns:
+            Taint ID for tracking
+        """
+        taint_id = f"taint-{self._next_taint_id:04d}"
+        self._next_taint_id += 1
+
+        taint = TaintedValue(
+            taint_id=taint_id,
+            origin_type=origin_type,
+            origin_name=origin_name,
+            origin_location=origin_location,
+            entry_point_id=entry_point_id,
+            current_variable=parameter_name,
+            current_function=function_qname,
+            current_file=origin_location[0],
+            depth=0,
+            path=[],
+        )
+
+        self._active_taints[taint_id] = taint
+        self._taints[function_qname][parameter_name].add(taint_id)
+        self._stats["taints_created"] += 1
+
+        return taint_id
+
+    def propagate_all(self) -> list[DataFlow]:
+        """
+        Propagate all taints through the call graph.
+
+        This is the main entry point for taint analysis. It propagates
+        all registered origins until they either:
+        - Reach max depth
+        - Hit a cycle
+        - Reach a leaf function (no more calls)
+
+        Returns:
+            List of discovered data flows
+        """
+        # Process each function in topological order (if possible)
+        # For now, process all functions that have taints
+        worklist = list(self._active_taints.keys())
+
+        while worklist:
+            taint_id = worklist.pop(0)
+
+            if taint_id not in self._active_taints:
+                continue
+
+            taint = self._active_taints[taint_id]
+
+            # Check depth limit
+            if taint.depth >= self._max_depth:
+                self._stats["max_depth_reached"] += 1
+                continue
+
+            # Check for cycles
+            state = (taint.current_function, taint.current_variable, taint.depth)
+            if state in self._visited:
+                self._stats["cycles_avoided"] += 1
+                continue
+            self._visited.add(state)
+
+            # Propagate through calls from this function
+            new_taints = self._propagate_function(taint)
+            worklist.extend(new_taints)
+
+        return self._flows
+
+    def _propagate_function(self, taint: TaintedValue) -> list[str]:
+        """
+        Propagate taint through calls made by a function.
+
+        Returns list of new taint IDs created.
+        """
+        new_taint_ids: list[str] = []
+
+        # Get all calls from this function
+        callees = self._call_graph.get_callees(taint.current_function)
+
+        for callee_qname in callees:
+            # Get the edges (call sites) for this caller-callee pair
+            # Filter edges from caller to this specific callee
+            edges = [
+                e
+                for e in self._call_graph.get_edges_from(taint.current_function)
+                if e.callee == callee_qname
+            ]
+
+            for edge in edges:
+                # Check if the tainted variable is passed to this call
+                taint_passes = self._check_taint_passes(taint, edge, callee_qname)
+
+                if taint_passes:
+                    arg_index, arg_name = taint_passes
+
+                    # Extract transformations along the derivation chain
+                    # from the tainted variable to the actual argument.
+                    chain_transforms = self._extract_transformations_in_chain(
+                        taint,
+                        arg_name if arg_name != "iterable" else taint.current_variable,
+                        edge.line,
+                    )
+                    inline_transforms = self._extract_arg_transformations(taint, edge, callee_qname)
+                    all_transforms = (
+                        list(taint.transformations) + chain_transforms + inline_transforms
+                    )
+
+                    # Record this as a flow to a function call (potential sink)
+                    flow = self._create_flow(
+                        taint,
+                        edge,
+                        callee_qname,
+                        arg_index,
+                        arg_name,
+                        extra_transformations=all_transforms,
+                    )
+                    self._flows.append(flow)
+                    self._stats["flows_found"] += 1
+
+                    # Continue propagation into the callee, carrying
+                    # accumulated transformations forward.
+                    if self._should_propagate_into(callee_qname):
+                        new_taint = self._create_propagated_taint(
+                            taint,
+                            edge,
+                            callee_qname,
+                            arg_name,
+                            accumulated_transforms=all_transforms,
+                        )
+                        if new_taint:
+                            new_taint_ids.append(new_taint.taint_id)
+
+                    # Return value propagation: if callee returns the tainted param,
+                    # the call result (if assigned) is tainted in the caller
+                    if self._flow_bindings and self._flow_bindings.function_returns_parameter(
+                        callee_qname, arg_name
+                    ):
+                        lhs = self._get_assignment_target_for_call(
+                            taint.current_function,
+                            edge.file_path,
+                            edge.line,
+                            callee_qname,
+                        )
+                        if lhs and taint.depth < self._max_depth - 1:
+                            return_taint = self._create_return_propagated_taint(
+                                taint,
+                                edge,
+                                lhs,
+                                accumulated_transforms=all_transforms,
+                            )
+                            if return_taint:
+                                new_taint_ids.append(return_taint.taint_id)
+
+                    # HOF: propagate taint into callback when data arg is tainted
+                    from .hof_catalog import is_known_hof
+
+                    if is_known_hof(callee_qname) and arg_name == "iterable":
+                        callback_qname = self._resolve_hof_callback(
+                            taint.current_function,
+                            edge.file_path,
+                            edge.line,
+                            callee_qname,
+                        )
+                        if (
+                            callback_qname
+                            and self._should_propagate_into(callback_qname)
+                            and taint.depth < self._max_depth - 1
+                        ):
+                            callback_node = self._call_graph.get_node(callback_qname)
+                            first_param = (
+                                callback_node.parameters[0]
+                                if callback_node and callback_node.parameters
+                                else "x"
+                            )
+                            cb_taint = self._create_propagated_taint(
+                                taint, edge, callback_qname, first_param
+                            )
+                            if cb_taint:
+                                new_taint_ids.append(cb_taint.taint_id)
+
+        return new_taint_ids
+
+    def _get_assignment_target_for_call(
+        self,
+        caller: str,
+        file_path: Path,
+        line: int,
+        callee: str,
+    ) -> str | None:
+        """
+        Find if the call result is assigned: x = callee(...).
+
+        Returns the target variable name if found, None otherwise.
+        Used for return value taint propagation.
+        """
+        parsed = self._parsed_files.get(file_path)
+        if not parsed or not hasattr(parsed, "assignments"):
+            return None
+        for assign in parsed.assignments:
+            if assign.location.line != line:
+                continue
+            if assign.source_type != "call" or not assign.source_call:
+                continue
+            assign_func = assign.in_function or ""
+            if assign_func != caller and not (caller and caller.endswith(f".{assign_func}")):
+                continue
+            # Match callee: source_call might be "get_id", callee might be "main.get_id"
+            sc = assign.source_call or ""
+            if (
+                sc == callee
+                or callee.endswith(f".{sc}")
+                or sc.endswith(f".{callee.split('.')[-1]}")
+            ):
+                return assign.target
+        return None
+
+    def _extract_transformations_in_chain(
+        self,
+        taint: TaintedValue,
+        arg_variable: str,
+        call_line: int,
+    ) -> list[Transformation]:
+        """
+        Walk the derivation chain from the taint's original variable to the
+        argument variable and record every transformation encountered.
+
+        For example:
+            user_id (tainted) → clean = int(user_id) → safe = html.escape(clean)
+            → foo(safe)
+
+        Returns:
+            [Transformation(type=function_call, function="int", ...),
+             Transformation(type=function_call, function="html.escape", ...)]
+        """
+        if not self._flow_bindings:
+            return []
+        if arg_variable == taint.current_variable:
+            return []
+
+        chain = self._flow_bindings.get_derivation_chain(
+            taint.current_function,
+            arg_variable,
+            taint.current_variable,
+            call_line,
+        )
+
+        if not chain:
+            return []
+
+        transforms: list[Transformation] = []
+        for defn in chain:
+            if defn.assigned_from_call:
+                if defn.is_method_call:
+                    ttype = TransformationType.METHOD_CALL
+                elif defn.is_string_interpolation:
+                    ttype = TransformationType.STRING_FORMAT
+                elif defn.assigned_from_call in (
+                    "int",
+                    "str",
+                    "float",
+                    "bool",
+                    "bytes",
+                    "complex",
+                ):
+                    ttype = TransformationType.TYPE_CONSTRUCTOR
+                else:
+                    ttype = TransformationType.FUNCTION_CALL
+
+                # Try to find the call site for this transformation to attach evidence
+                call_ev = self._get_transformation_call_evidence(
+                    taint.current_function,
+                    taint.current_file,
+                    defn.line,
+                    defn.variable,
+                )
+
+                transforms.append(
+                    Transformation(
+                        type=ttype,
+                        description=None,
+                        location=(taint.current_file, defn.line),
+                        function=defn.assigned_from_call,
+                        depth=taint.depth,
+                        call_evidence=call_ev,
+                    )
+                )
+            elif defn.is_string_interpolation:
+                transforms.append(
+                    Transformation(
+                        type=TransformationType.STRING_FORMAT,
+                        description=None,
+                        location=(taint.current_file, defn.line),
+                        function=None,
+                        depth=taint.depth,
+                    )
+                )
+
+        return transforms
+
+    def _get_transformation_call_evidence(
+        self,
+        function_qname: str,
+        file_path: Path,
+        line: int,
+        tainted_var: str | None,
+    ) -> Any:
+        """Look up the call site for a transformation assignment and build evidence."""
+        from .sink_evidence import build_evidence_for_call_site
+
+        cs = self._get_call_site(function_qname, file_path, line)
+        if cs is None:
+            return None
+        # For a transformation like `clean = int(uid)`, the call site is
+        # `int(uid)`.  We identify which argument carries the tainted
+        # variable by matching source_variables.
+        tainted_idx: int | None = None
+        tainted_name: str | None = None
+        if tainted_var:
+            for arg in cs.arguments:
+                if arg.is_variable and arg.variable_name == tainted_var:
+                    tainted_idx = arg.position
+                    tainted_name = arg.name
+                    break
+                if tainted_var in arg.source_variables:
+                    tainted_idx = arg.position
+                    tainted_name = arg.name
+                    break
+        return build_evidence_for_call_site(
+            cs,
+            tainted_arg_index=tainted_idx,
+            tainted_arg_name=tainted_name,
+        )
+
+    def _extract_arg_transformations(
+        self,
+        taint: TaintedValue,
+        edge: CallGraphEdge,
+        callee_qname: str,
+    ) -> list[Transformation]:
+        """
+        Check whether the call argument itself is a transformation (inline).
+
+        Handles the pattern: foo(int(user_id)) where int() wraps the tainted
+        variable directly in the call argument.
+        """
+        call_site = self._get_call_site(taint.current_function, edge.file_path, edge.line)
+        if not call_site or not call_site.arguments:
+            return []
+
+        transforms: list[Transformation] = []
+        for arg in call_site.arguments:
+            if arg.is_call_result and arg.called_function:
+                # The argument is the result of a call — check if the
+                # called function wraps the tainted variable.
+                # E.g. foo(int(user_id)) — arg is int(user_id).
+                if arg.expression_text and taint.current_variable in (arg.expression_text):
+                    ttype = (
+                        TransformationType.TYPE_CONSTRUCTOR
+                        if (
+                            arg.called_function
+                            in (
+                                "int",
+                                "str",
+                                "float",
+                                "bool",
+                                "bytes",
+                            )
+                        )
+                        else TransformationType.FUNCTION_CALL
+                    )
+                    transforms.append(
+                        Transformation(
+                            type=ttype,
+                            description=None,
+                            location=(edge.file_path, edge.line),
+                            function=arg.called_function,
+                            depth=taint.depth,
+                        )
+                    )
+        return transforms
+
+    def _resolve_hof_callback(
+        self,
+        caller: str,
+        file_path: Path,
+        line: int,
+        hof_callee: str,
+    ) -> str | None:
+        """
+        Resolve the callback argument of a HOF call to a function in the call graph.
+        E.g. map(sanitize, data) -> resolve "sanitize" to "main.sanitize" if in graph.
+        """
+        from .hof_catalog import get_hof_callback_position
+
+        callback_pos = get_hof_callback_position(hof_callee)
+        if callback_pos is None:
+            return None
+        call_site = self._get_call_site(caller, file_path, line)
+        if not call_site or not call_site.arguments:
+            return None
+        for arg in call_site.arguments:
+            if arg.position != callback_pos:
+                continue
+            name = arg.variable_name if (arg.is_variable and arg.variable_name) else None
+            if not name:
+                continue
+            # Try as qualified name
+            if self._call_graph.get_node(name):
+                return name
+            # Try with caller's module prefix
+            if "." in caller:
+                prefix = caller.rsplit(".", 1)[0]
+                candidate = f"{prefix}.{name}"
+                if self._call_graph.get_node(candidate):
+                    return candidate
+            # Try any symbol that ends with .name
+            for sym in self._call_graph._symbols:
+                if sym == name or sym.endswith(f".{name}"):
+                    return sym
+            return None
+        return None
+
+    def _get_call_site(
+        self,
+        caller: str,
+        file_path: Path,
+        line: int,
+        callee_hint: str | None = None,
+    ) -> ParsedCallSite | None:
+        """
+        Look up the ParsedCallSite for a call at (caller, file_path, line).
+
+        When multiple calls share a line (e.g. ``Template(content).render()``),
+        *callee_hint* disambiguates: it prefers the call site whose callee_name
+        matches the hint.
+        """
+        parsed = self._parsed_files.get(file_path)
+        if not parsed or not hasattr(parsed, "call_sites"):
+            return None
+
+        candidates: list[ParsedCallSite] = []
+        for call in parsed.call_sites:
+            if call.location.line != line:
+                continue
+            caller_qn = call.caller_function
+            caller_str = (
+                caller_qn.full
+                if caller_qn and hasattr(caller_qn, "full")
+                else str(caller_qn)
+                if caller_qn
+                else ""
+            )
+            if (
+                caller_str == caller
+                or caller_str
+                and caller.endswith(f".{caller_str}")
+                or caller_str
+                and caller_str.endswith(f".{caller.split('.')[-1]}")
+            ):
+                candidates.append(call)
+
+        if not candidates:
+            return None
+        if len(candidates) == 1 or not callee_hint:
+            return candidates[0]
+
+        callee_leaf = callee_hint.rsplit(".", 1)[-1]
+        for c in candidates:
+            cname = c.callee_name or ""
+            if cname in (callee_hint, callee_leaf) or cname.endswith(f".{callee_leaf}"):
+                return c
+        return candidates[0]
+
+    def _check_taint_passes(
+        self,
+        taint: TaintedValue,
+        edge: CallGraphEdge,
+        callee_qname: str,
+    ) -> tuple[int, str] | None:
+        """
+        Check if tainted variable is passed to this call.
+
+        Uses actual call-site argument analysis when available for accuracy.
+        Falls back to heuristics when call site cannot be resolved.
+
+        Returns (argument_index, parameter_name) if taint passes, None otherwise.
+        """
+        tainted_var = taint.current_variable
+        callee_node = self._call_graph.get_node(callee_qname)
+        callee_params = callee_node.parameters if callee_node else []
+
+        call_site = self._get_call_site(
+            taint.current_function,
+            edge.file_path,
+            edge.line,
+            callee_hint=callee_qname,
+        )
+
+        if call_site and call_site.arguments:
+            # Precise: check which argument passes the tainted variable
+            # Use value-flow (variable_derives_from) for renaming: uid = user_id;
+            # foo(uid) should propagate taint
+            # Handle *args and **kwargs: tainted *var or **var spreads to callee
+            for arg in call_site.arguments:
+                arg_var = None
+                if arg.is_variable and arg.variable_name or arg.is_spread or arg.is_keyword_spread:
+                    arg_var = arg.variable_name
+                if not arg_var:
+                    continue
+                # Direct match or value-flow (variable renaming): does arg_var
+                # derive from tainted_var? e.g. uid = user_id; foo(uid)
+                if arg_var != tainted_var:
+                    if self._flow_bindings:
+                        if not self._flow_bindings.variable_derives_from(
+                            taint.current_function,
+                            arg_var,
+                            tainted_var,
+                            edge.line,
+                        ):
+                            continue
+                    else:
+                        continue
+                # This argument passes the tainted variable (or derives from it)
+                param_index = arg.position
+                param_name = None
+                if arg.name and callee_params:
+                    # Keyword argument: find param by name
+                    for i, p in enumerate(callee_params):
+                        if p == arg.name:
+                            param_index = i
+                            param_name = p
+                            break
+                elif param_index is not None and param_index < len(callee_params):
+                    param_name = callee_params[param_index]
+                else:
+                    param_name = tainted_var
+                return (param_index if param_index is not None else 0, param_name or tainted_var)
+            # Precise analysis had call-site arguments but none carried taint;
+            # trust the verdict and skip heuristic fallback.
+            return None
+
+        # Fallback: heuristic-based matching (only when call-site is unresolved)
+        if callee_params:
+            for i, param in enumerate(callee_params):
+                if param == tainted_var or tainted_var.endswith(f".{param}"):
+                    return (i, param)
+                if param in ("data", "value", "input", "content", "payload"):
+                    return (i, param)
+
+        if self._is_likely_data_variable(tainted_var):
+            return (0, callee_params[0] if callee_params else tainted_var)
+
+        # HOF: map(f, data), filter(f, data) - taint in data arg flows to callback
+        from .hof_catalog import get_hof_data_position, is_known_hof
+
+        if is_known_hof(callee_qname):
+            data_pos = get_hof_data_position(callee_qname)
+            if data_pos is not None and call_site and call_site.arguments:
+                for arg in call_site.arguments:
+                    if arg.position != data_pos:
+                        continue
+                    arg_var = arg.variable_name if (arg.is_variable and arg.variable_name) else None
+                    if not arg_var:
+                        continue
+                    if arg_var == tainted_var:
+                        return (data_pos, "iterable")
+                    if self._flow_bindings and self._flow_bindings.variable_derives_from(
+                        taint.current_function, arg_var, tainted_var, edge.line
+                    ):
+                        return (data_pos, "iterable")
+
+        return None
+
+    def _is_likely_data_variable(self, var_name: str) -> bool:
+        """Check if variable name strongly suggests it carries user data.
+
+        Only matches terms that almost always indicate untrusted input.
+        Generic terms like "name", "id", "value", "result", "response"
+        are excluded because they appear frequently in non-tainted contexts.
+        """
+        import re as _re
+
+        _STRONG_DATA_PATTERNS = {
+            "data",
+            "input",
+            "body",
+            "payload",
+            "content",
+            "request",
+            "params",
+            "query",
+            "form",
+            "json",
+            "user_input",
+            "user_data",
+            "raw_input",
+            "email",
+            "password",
+            "token",
+        }
+
+        var_lower = var_name.lower()
+        # Exact match on the full variable name or the last dotted segment
+        leaf = var_lower.rsplit(".", 1)[-1]
+        if leaf in _STRONG_DATA_PATTERNS:
+            return True
+
+        # Word-boundary match so "user_payload" hits but "response" does not
+        for pattern in _STRONG_DATA_PATTERNS:
+            if _re.search(rf"(?:^|_){_re.escape(pattern)}(?:_|$)", leaf):
+                return True
+
+        return False
+
+    def _create_flow(
+        self,
+        taint: TaintedValue,
+        edge: CallGraphEdge,
+        callee_qname: str,
+        arg_index: int,
+        arg_name: str,
+        extra_transformations: list[Transformation] | None = None,
+    ) -> DataFlow:
+        """Create a DataFlow record for a taint reaching a function call."""
+        flow_id = stable_id(
+            "flow",
+            taint.origin_type.name,
+            taint.entry_point_id or "",
+            callee_qname,
+            str(arg_index),
+            arg_name,
+            str(edge.file_path),
+            str(edge.line),
+        )
+
+        # Build the path
+        path = list(taint.path)
+        path.append(
+            FlowStep(
+                depth=taint.depth + 1,
+                caller=taint.current_function,
+                callee=callee_qname,
+                argument_index=arg_index,
+                argument_name=arg_name,
+                location=(edge.file_path, edge.line),
+                variable_mapping={taint.current_variable: arg_name},
+            )
+        )
+
+        # Get context at sink
+        sink_context = {
+            "in_loop": edge.in_loop,
+            "in_conditional": edge.in_conditional,
+            "in_try_block": edge.in_try_block,
+            "in_except_handler": edge.in_except_handler,
+        }
+
+        # Merge transformations: accumulated from propagation + chain + inline.
+        # Deduplicate by (function, line) to avoid repeats.
+        all_transforms = extra_transformations or list(taint.transformations)
+        seen_keys: set[tuple[str | None, int]] = set()
+        deduped: list[Transformation] = []
+        for t in all_transforms:
+            key = (t.function, t.location[1])
+            if key not in seen_keys:
+                seen_keys.add(key)
+                deduped.append(t)
+
+        return DataFlow(
+            id=flow_id,
+            origin_type=taint.origin_type,
+            origin_name=taint.origin_name,
+            origin_location=taint.origin_location,
+            entry_point_id=taint.entry_point_id,
+            sink_function=callee_qname,
+            sink_argument_index=arg_index,
+            sink_argument_name=arg_name,
+            sink_location=(edge.file_path, edge.line),
+            sink_call_id=None,
+            path=path,
+            depth=len(path),
+            truncated=taint.depth >= self._max_depth - 1,
+            transformations=deduped,
+            sink_context=sink_context,
+            confidence="HIGH" if taint.depth < 3 else "MEDIUM",
+        )
+
+    def _should_propagate_into(self, callee_qname: str) -> bool:
+        """Check if we should continue propagation into this function."""
+        # Don't propagate into external/library functions
+        node = self._call_graph.get_node(callee_qname)
+        if node is None:
+            return False
+
+        # Don't propagate into builtins
+        if callee_qname.startswith("builtins."):
+            return False
+
+        # Don't propagate into known library functions
+        library_prefixes = {
+            # Python
+            "sqlalchemy.",
+            "django.",
+            "flask.",
+            "fastapi.",
+            "pydantic.",
+            "requests.",
+            "httpx.",
+            "aiohttp.",
+            "json.",
+            "os.",
+            "sys.",
+            "subprocess.",
+            "logging.",
+            # Java standard library and major frameworks
+            "java.",
+            "javax.",
+            "jakarta.",
+            "org.springframework.",
+            "io.micronaut.",
+            "com.google.",
+            "com.fasterxml.",  # Jackson
+            "org.apache.",
+            "org.slf4j.",
+            "org.hibernate.",
+            "io.jsonwebtoken.",
+            # .NET standard library and ASP.NET Core
+            "System.",
+            "Microsoft.",
+            "Newtonsoft.",
+            "AutoMapper.",
+            "FluentValidation.",
+        }
+        return all(not callee_qname.startswith(prefix) for prefix in library_prefixes)
+
+    def _create_propagated_taint(
+        self,
+        source_taint: TaintedValue,
+        edge: CallGraphEdge,
+        callee_qname: str,
+        param_name: str,
+        accumulated_transforms: list[Transformation] | None = None,
+    ) -> TaintedValue | None:
+        """Create a new taint for propagation into a callee."""
+        taint_id = f"taint-{self._next_taint_id:04d}"
+        self._next_taint_id += 1
+
+        # Build updated path
+        new_path = list(source_taint.path)
+        new_path.append(
+            FlowStep(
+                depth=source_taint.depth + 1,
+                caller=source_taint.current_function,
+                callee=callee_qname,
+                argument_index=0,
+                argument_name=param_name,
+                location=(edge.file_path, edge.line),
+                variable_mapping={source_taint.current_variable: param_name},
+            )
+        )
+
+        new_taint = TaintedValue(
+            taint_id=taint_id,
+            origin_type=source_taint.origin_type,
+            origin_name=source_taint.origin_name,
+            origin_location=source_taint.origin_location,
+            entry_point_id=source_taint.entry_point_id,
+            current_variable=param_name,
+            current_function=callee_qname,
+            current_file=edge.file_path,
+            depth=source_taint.depth + 1,
+            path=new_path,
+            transformations=accumulated_transforms
+            if accumulated_transforms is not None
+            else list(source_taint.transformations),
+            metadata=dict(source_taint.metadata),
+        )
+
+        self._active_taints[taint_id] = new_taint
+        self._taints[callee_qname][param_name].add(taint_id)
+        self._stats["taints_created"] += 1
+
+        return new_taint
+
+    def _create_return_propagated_taint(
+        self,
+        source_taint: TaintedValue,
+        edge: CallGraphEdge,
+        lhs_variable: str,
+        accumulated_transforms: list[Transformation] | None = None,
+    ) -> TaintedValue | None:
+        """
+        Create taint for LHS when callee returns tainted value.
+
+        E.g. user_id = get_id() where get_id returns request.args.get("id").
+        The taint propagates from callee's return to caller's lhs_variable.
+        """
+        taint_id = f"taint-{self._next_taint_id:04d}"
+        self._next_taint_id += 1
+
+        new_taint = TaintedValue(
+            taint_id=taint_id,
+            origin_type=source_taint.origin_type,
+            origin_name=source_taint.origin_name,
+            origin_location=source_taint.origin_location,
+            entry_point_id=source_taint.entry_point_id,
+            current_variable=lhs_variable,
+            current_function=source_taint.current_function,
+            current_file=source_taint.current_file,
+            depth=source_taint.depth,
+            path=list(source_taint.path),
+            transformations=accumulated_transforms
+            if accumulated_transforms is not None
+            else list(source_taint.transformations),
+            metadata=dict(source_taint.metadata),
+        )
+
+        self._active_taints[taint_id] = new_taint
+        caller = source_taint.current_function
+        self._taints[caller][lhs_variable].add(taint_id)
+        self._stats["taints_created"] += 1
+
+        return new_taint
+
+    def get_statistics(self) -> dict[str, int]:
+        """Get propagation statistics."""
+        return dict(self._stats)
+
+
+# =============================================================================
+# Source Identifier
+# =============================================================================
+
+
+class SourceIdentifier:
+    """
+    Identifies data origins from entry points.
+
+    This analyzes entry-point handlers to find where untrusted data enters:
+    - HTTP: path/query/body/header/cookie parameters
+    - CLI: arguments and options (user input)
+    - Task/Consumer/Scheduled: message-broker parameters
+    - Webhook/Event: external system callback parameters
+    """
+
+    # FastAPI parameter patterns
+    FASTAPI_PATH_PARAM = {"Path"}
+    FASTAPI_QUERY_PARAM = {"Query"}
+    FASTAPI_BODY_PARAM = {"Body", "Form", "File"}
+    FASTAPI_HEADER_PARAM = {"Header"}
+    FASTAPI_COOKIE_PARAM = {"Cookie"}
+
+    # Default OriginType per non-HTTP entry-point kind
+    _KIND_ORIGIN_MAP: dict[str, OriginType] = {
+        "cli": OriginType.USER_INPUT,
+        "task": OriginType.MESSAGE_QUEUE,
+        "consumer": OriginType.MESSAGE_QUEUE,
+        "scheduled": OriginType.MESSAGE_QUEUE,
+        "webhook": OriginType.EXTERNAL_API,
+        "event": OriginType.EXTERNAL_API,
+    }
+
+    # CLI-specific location values → OriginType
+    _CLI_LOCATION_ORIGINS: dict[str, OriginType] = {
+        "cli_argument": OriginType.USER_INPUT,
+        "cli_option": OriginType.USER_INPUT,
+    }
+
+    _SIMPLE_TYPES = frozenset(
+        {
+            "str",
+            "int",
+            "float",
+            "bool",
+            "bytes",
+            "Optional[str]",
+            "Optional[int]",
+            "Optional[float]",
+            "Optional[bool]",
+            "str | None",
+            "int | None",
+            "float | None",
+            "bool | None",
+        }
+    )
+
+    def __init__(self):
+        self._origins: list[dict[str, Any]] = []
+
+    def identify_from_function(
+        self,
+        func: ParsedFunction,
+        entry_point_id: str | None = None,
+        route_path: str | None = None,
+        param_locations: dict[str, str] | None = None,
+        entry_point_kind: str | None = None,
+    ) -> list[dict[str, Any]]:
+        """
+        Identify data origins from a function (entry-point handler).
+
+        Args:
+            func: The parsed handler function.
+            entry_point_id: Stable ID of the entry point.
+            route_path: URL path template (HTTP only).
+            param_locations: Pre-classified param name → location string.
+            entry_point_kind: Entry-point kind (``"http"``, ``"cli"``,
+                ``"task"``, ``"consumer"``, ``"scheduled"``, ``"webhook"``,
+                ``"event"``).  ``None`` is treated as ``"http"`` for
+                backwards compatibility.
+
+        Returns:
+            List of origin info dicts.
+        """
+        origins: list[dict[str, Any]] = []
+
+        for param in func.parameters:
+            origin = self._classify_parameter(
+                param,
+                func,
+                route_path,
+                param_locations,
+                entry_point_kind,
+            )
+            if origin:
+                origin["entry_point_id"] = entry_point_id
+                origin["function_qname"] = func.qualified_name.full
+                origins.append(origin)
+
+        return origins
+
+    def _classify_parameter(
+        self,
+        param: Any,  # ParsedParameter
+        func: ParsedFunction,
+        route_path: str | None,
+        param_locations: dict[str, str] | None = None,
+        entry_point_kind: str | None = None,
+    ) -> dict[str, Any] | None:
+        """Classify a parameter as a data origin."""
+        param_name = param.name
+        param_type = param.type_annotation
+        default_value = param.default_value
+
+        # Skip self/cls
+        if param_name in ("self", "cls"):
+            return None
+
+        # Non-HTTP entry points use kind-based classification
+        if entry_point_kind and entry_point_kind != "http":
+            return self._classify_non_http_parameter(
+                param,
+                func,
+                entry_point_kind,
+                param_locations,
+            )
+
+        # Java/Spring & .NET: annotations stored in param.metadata by the language parser.
+        param_metadata = getattr(param, "metadata", {}) or {}
+        if param_metadata:
+            spring_origin = self._classify_spring_param(param_name, param_metadata)
+            if spring_origin:
+                return {
+                    "type": spring_origin,
+                    "name": param_name,
+                    "location": (func.location.file, func.location.line),
+                    "parameter_name": param_name,
+                    "inferred_from": "spring_annotation",
+                }
+            dotnet_origin = self._classify_dotnet_param(param_name, param_metadata)
+            if dotnet_origin:
+                return {
+                    "type": dotnet_origin,
+                    "name": param_name,
+                    "location": (func.location.file, func.location.line),
+                    "parameter_name": param_name,
+                    "inferred_from": "dotnet_annotation",
+                }
+
+        # Use pre-classified location from the entry_point if available
+        # (single source of truth from ParameterAnalyzer).
+        if param_locations and param_name in param_locations:
+            origin_type_name = param_locations[param_name]
+            return {
+                "type": OriginType[origin_type_name],
+                "name": param_name,
+                "location": (func.location.file, func.location.line),
+                "parameter_name": param_name,
+                "inferred_from": "entry_point_classification",
+            }
+
+        # Check for path parameter (appears in route path) — checked before
+        # body-type heuristic so that a param named e.g. "code" in the URL
+        # template is not misclassified as body due to its type annotation.
+        if route_path and f"{{{param_name}}}" in route_path:
+            return {
+                "type": OriginType.HTTP_PATH_PARAM,
+                "name": param_name,
+                "location": (func.location.file, func.location.line),
+                "parameter_name": param_name,
+                "inferred_from": "route_path",
+            }
+
+        # Check type annotation for Pydantic models (likely body)
+        if param_type and self._is_likely_body_type(param_type):
+            return {
+                "type": OriginType.HTTP_BODY,
+                "name": param_name,
+                "location": (func.location.file, func.location.line),
+                "parameter_name": param_name,
+                "inferred_from": "type_annotation",
+            }
+
+        # Check default value for FastAPI dependency patterns
+        if default_value:
+            origin_type = self._classify_fastapi_default(default_value)
+            if origin_type:
+                return {
+                    "type": origin_type,
+                    "name": param_name,
+                    "location": (func.location.file, func.location.line),
+                    "parameter_name": param_name,
+                    "inferred_from": "default_value",
+                }
+
+        # Check for common parameter names
+        if self._is_likely_query_param_name(param_name):
+            return {
+                "type": OriginType.HTTP_QUERY_PARAM,
+                "name": param_name,
+                "location": (func.location.file, func.location.line),
+                "parameter_name": param_name,
+                "inferred_from": "name_heuristic",
+            }
+
+        # FastAPI fallback: simple-typed params not in path are query params.
+        # Depends()-injected params were already handled above; anything
+        # left with a primitive type annotation is user-supplied input.
+        if param_type and param_type in self._SIMPLE_TYPES:
+            return {
+                "type": OriginType.HTTP_QUERY_PARAM,
+                "name": param_name,
+                "location": (func.location.file, func.location.line),
+                "parameter_name": param_name,
+                "inferred_from": "fastapi_simple_type_fallback",
+            }
+
+        return None
+
+    def _is_likely_body_type(self, type_annotation: str) -> bool:
+        """Check if type annotation suggests a request body."""
+        # Pydantic models typically end with Model, Schema, etc.
+        body_patterns = {
+            "Model",
+            "Schema",
+            "Request",
+            "Input",
+            "Create",
+            "Update",
+            "Payload",
+            "Body",
+            "Data",
+            "DTO",
+        }
+
+        for pattern in body_patterns:
+            if pattern in type_annotation:
+                return True
+
+        # Check for common base types that are NOT body
+        non_body = {"str", "int", "float", "bool", "list", "dict", "Optional", "None"}
+        if type_annotation in non_body:
+            return False
+
+        # If it's a custom type (starts with uppercase), likely a model
+        return bool(type_annotation and type_annotation[0].isupper())
+
+    def _classify_fastapi_default(self, default_value: str) -> OriginType | None:
+        """Classify FastAPI parameter defaults."""
+        default_lower = default_value.lower()
+
+        if any(p.lower() in default_lower for p in self.FASTAPI_PATH_PARAM):
+            return OriginType.HTTP_PATH_PARAM
+        if any(p.lower() in default_lower for p in self.FASTAPI_QUERY_PARAM):
+            return OriginType.HTTP_QUERY_PARAM
+        if any(p.lower() in default_lower for p in self.FASTAPI_BODY_PARAM):
+            return OriginType.HTTP_BODY
+        if any(p.lower() in default_lower for p in self.FASTAPI_HEADER_PARAM):
+            return OriginType.HTTP_HEADER
+        if any(p.lower() in default_lower for p in self.FASTAPI_COOKIE_PARAM):
+            return OriginType.HTTP_COOKIE
+
+        return None
+
+    def _classify_spring_param(
+        self, param_name: str, metadata: dict[str, Any]
+    ) -> OriginType | None:
+        """Classify a Spring / Micronaut method parameter from its annotation metadata.
+
+        The JVM parser stores param annotations as:
+            {"PathVariable": "slug"}         → HTTP_PATH_PARAM
+            {"RequestParam": "page"}         → HTTP_QUERY_PARAM
+            {"RequestBody": None}            → HTTP_BODY
+            {"RequestHeader": "X-API-Key"}   → HTTP_HEADER
+            {"CookieValue": "session"}       → HTTP_COOKIE
+            {"QueryValue": "limit"}          → HTTP_QUERY_PARAM  (Micronaut)
+            {"Body": None}                   → HTTP_BODY          (Micronaut)
+            {"Header": "X-Token"}            → HTTP_HEADER        (Micronaut)
+        """
+        ann_keys = {k.lower() for k in metadata}
+        if "pathvariable" in ann_keys or "uriinfo" in ann_keys:
+            return OriginType.HTTP_PATH_PARAM
+        if "requestparam" in ann_keys or "queryvalue" in ann_keys or "queryparam" in ann_keys:
+            return OriginType.HTTP_QUERY_PARAM
+        if "requestbody" in ann_keys or "body" in ann_keys:
+            return OriginType.HTTP_BODY
+        if "requestheader" in ann_keys or "header" in ann_keys:
+            return OriginType.HTTP_HEADER
+        if "cookievalue" in ann_keys or "cookieparam" in ann_keys:
+            return OriginType.HTTP_COOKIE
+        if "matrixparam" in ann_keys:
+            return OriginType.HTTP_QUERY_PARAM
+        return None
+
+    def _classify_dotnet_param(
+        self, param_name: str, metadata: dict[str, Any]
+    ) -> OriginType | None:
+        """Classify an ASP.NET Core / Minimal API parameter from its attribute metadata.
+
+        The C# parser stores binding attributes as metadata keys (value is True or a
+        string for named params):
+            {"FromRoute": True}      → HTTP_PATH_PARAM
+            {"FromQuery": True}      → HTTP_QUERY_PARAM
+            {"FromBody": True}       → HTTP_BODY
+            {"FromForm": True}       → HTTP_FORM
+            {"FromHeader": True}     → HTTP_HEADER
+            {"FromServices": True}   → None (DI, not user input)
+        """
+        ann_keys = {k.lower() for k in metadata}
+        if "fromroute" in ann_keys or "fromuriattribute" in ann_keys:
+            return OriginType.HTTP_PATH_PARAM
+        if "fromquery" in ann_keys or "fromuniformresourceidentifier" in ann_keys:
+            return OriginType.HTTP_QUERY_PARAM
+        if "frombody" in ann_keys:
+            return OriginType.HTTP_BODY
+        if "fromform" in ann_keys:
+            return OriginType.HTTP_FORM
+        if "fromheader" in ann_keys:
+            return OriginType.HTTP_HEADER
+        if "fromservices" in ann_keys or "inject" in ann_keys or "fromkeyedservices" in ann_keys:
+            return None  # DI injection — not user input
+        return None
+
+    def _is_likely_query_param_name(self, param_name: str) -> bool:
+        """Check if parameter name suggests a query parameter."""
+        query_patterns = {
+            "page",
+            "limit",
+            "offset",
+            "skip",
+            "take",
+            "sort",
+            "order",
+            "filter",
+            "search",
+            "query",
+            "q",
+            "start",
+            "end",
+            "from",
+            "to",
+        }
+
+        return param_name.lower() in query_patterns
+
+    # -----------------------------------------------------------------
+    # Non-HTTP entry-point classification
+    # -----------------------------------------------------------------
+
+    def _classify_non_http_parameter(
+        self,
+        param: Any,  # ParsedParameter
+        func: ParsedFunction,
+        kind: str,
+        param_locations: dict[str, str] | None = None,
+    ) -> dict[str, Any] | None:
+        """Classify a parameter from a non-HTTP entry point.
+
+        For CLI entry points parameters are treated as direct user input.
+        For task / consumer / scheduled entry points parameters arrive via
+        a message broker (deserialized payloads).  For webhook / event entry
+        points parameters originate from an external system callback.
+
+        Pre-classified *param_locations* are honoured first; if a location
+        value is not a valid ``OriginType`` name it is checked against the
+        CLI-specific location table (``cli_argument``, ``cli_option``).
+        """
+        param_name = param.name
+
+        # Check pre-classified location metadata from the entry point
+        if param_locations and param_name in param_locations:
+            location_value = param_locations[param_name]
+
+            # Try as a canonical OriginType enum name (e.g. "USER_INPUT")
+            try:
+                origin_type = OriginType[location_value]
+            except KeyError:
+                # CLI-specific location descriptors
+                origin_type = self._CLI_LOCATION_ORIGINS.get(
+                    location_value,
+                    self._KIND_ORIGIN_MAP.get(kind, OriginType.UNKNOWN),
+                )
+
+            return {
+                "type": origin_type,
+                "name": param_name,
+                "location": (func.location.file, func.location.line),
+                "parameter_name": param_name,
+                "inferred_from": "entry_point_classification",
+            }
+
+        # Fall back to the default origin for the entry-point kind
+        origin_type = self._KIND_ORIGIN_MAP.get(kind, OriginType.UNKNOWN)
+        return {
+            "type": origin_type,
+            "name": param_name,
+            "location": (func.location.file, func.location.line),
+            "parameter_name": param_name,
+            "inferred_from": f"{kind}_default",
+        }
+
+
+# =============================================================================
+# Data Flow Analyzer
+# =============================================================================
+
+
+class DataFlowAnalyzer:
+    """
+    Main class for inter-procedural data flow analysis.
+
+    Usage:
+        analyzer = DataFlowAnalyzer(
+            call_graph=call_graph,
+            parsed_files=parsed_files,
+            entry_points=entry_points,
+            max_depth=10,
+        )
+
+        flows = analyzer.analyze()
+    """
+
+    def __init__(
+        self,
+        call_graph: CallGraph,
+        parsed_files: list[ParsedFile],
+        entry_points: list[dict[str, Any]],
+        flow_bindings: FlowSensitiveBindings | None = None,
+        max_depth: int = 10,
+    ):
+        self._call_graph = call_graph
+        self._parsed_files = {pf.path: pf for pf in parsed_files if pf.success}
+        self._entry_points = entry_points
+        self._flow_bindings = flow_bindings
+        self._max_depth = max_depth
+
+        # Function lookup
+        self._functions: dict[str, ParsedFunction] = {}
+        self._build_function_index()
+
+        # Results
+        self._flows: list[DataFlow] = []
+
+        # Statistics
+        self._stats = {
+            "entry_points_analyzed": 0,
+            "origins_identified": 0,
+            "flows_discovered": 0,
+            "truncated_flows": 0,
+        }
+
+    def _build_function_index(self) -> None:
+        """Build index of functions by qualified name."""
+        for parsed in self._parsed_files.values():
+            for func in parsed.functions:
+                qname = func.qualified_name.full
+                self._functions[qname] = func
+
+            for cls in parsed.classes:
+                for method in cls.methods:
+                    qname = method.qualified_name.full
+                    self._functions[qname] = method
+
+    def _get_parsed_file_for_function(self, func: ParsedFunction) -> ParsedFile | None:
+        """Get the ParsedFile that contains this function."""
+        if not func.location:
+            return None
+        file_path = getattr(func.location, "file", None) or getattr(func, "file_path", None)
+        if not file_path:
+            return None
+        path = Path(file_path) if not isinstance(file_path, Path) else file_path
+        return self._parsed_files.get(path)
+
+    def analyze(self) -> list[DataFlow]:
+        """
+        Run data flow analysis on all entry points.
+
+        Returns list of discovered data flows.
+        """
+        logger.info(
+            f"Starting data flow analysis: "
+            f"{len(self._entry_points)} entry points, "
+            f"max depth {self._max_depth}"
+        )
+
+        # Initialize taint propagator (with parsed files for call-site analysis)
+        propagator = TaintPropagator(
+            self._call_graph,
+            self._flow_bindings,
+            self._max_depth,
+            parsed_files=list(self._parsed_files.values()),
+        )
+
+        # Source identifier (parameter-based origins)
+        source_id = SourceIdentifier()
+
+        # Process each entry point (framework from route for read-site detection)
+        for ep in self._entry_points:
+            framework = ep.get("framework") or "fastapi"
+            ep_kind = ep.get("kind")  # "http", "cli", "task", …
+            self._stats["entry_points_analyzed"] += 1
+
+            # Get the handler function
+            handler_qname = ep.get("handler_qualified_name")
+            if not handler_qname:
+                continue
+
+            func = self._functions.get(handler_qname)
+            if not func:
+                continue
+
+            # Build param location lookup from the entry_point's classified params
+            # so data flow origin types stay consistent with entry_point classification.
+            param_locations: dict[str, str] = {}
+            for p in ep.get("path_params", []):
+                pname = p.get("name") if isinstance(p, dict) else getattr(p, "name", None)
+                if pname:
+                    param_locations[pname] = "HTTP_PATH_PARAM"
+            for p in ep.get("query_params", []):
+                pname = p.get("name") if isinstance(p, dict) else getattr(p, "name", None)
+                if pname:
+                    param_locations[pname] = "HTTP_QUERY_PARAM"
+            for p in ep.get("header_params", []):
+                pname = p.get("name") if isinstance(p, dict) else getattr(p, "name", None)
+                if pname:
+                    param_locations[pname] = "HTTP_HEADER"
+            for p in ep.get("cookie_params", []):
+                pname = p.get("name") if isinstance(p, dict) else getattr(p, "name", None)
+                if pname:
+                    param_locations[pname] = "HTTP_COOKIE"
+            ep_body = ep.get("body")
+            if ep_body:
+                body_fields = (
+                    ep_body.get("model_fields", [])
+                    if isinstance(ep_body, dict)
+                    else getattr(ep_body, "model_fields", [])
+                )
+                for f in body_fields:
+                    fname = (
+                        f
+                        if isinstance(f, str)
+                        else (f.get("name") if isinstance(f, dict) else getattr(f, "name", None))
+                    )
+                    if fname:
+                        param_locations[fname] = "HTTP_BODY"
+
+            # Non-HTTP entry points may carry parameter metadata in a
+            # generic "parameters" list with per-param "location" values
+            # (e.g. "cli_argument", "cli_option").
+            if not param_locations:
+                for p in ep.get("parameters", []):
+                    pname = p.get("name") if isinstance(p, dict) else getattr(p, "name", None)
+                    ploc = (
+                        p.get("location") if isinstance(p, dict) else getattr(p, "location", None)
+                    )
+                    if pname and ploc:
+                        param_locations[pname] = ploc
+
+            route_path = ep.get("path", "")
+            origins = source_id.identify_from_function(
+                func,
+                entry_point_id=ep.get("id"),
+                route_path=route_path,
+                param_locations=param_locations if param_locations else None,
+                entry_point_kind=ep_kind,
+            )
+
+            # Register parameter-based origins
+            for origin in origins:
+                self._stats["origins_identified"] += 1
+                propagator.add_origin(
+                    origin_type=origin["type"],
+                    origin_name=origin["name"],
+                    origin_location=origin["location"],
+                    entry_point_id=origin.get("entry_point_id"),
+                    function_qname=origin["function_qname"],
+                    parameter_name=origin["parameter_name"],
+                )
+
+            # Read-site origins: request.path_params["id"], request.args.get("x"), etc.
+            parsed_file = self._get_parsed_file_for_function(func)
+            if parsed_file:
+                from .read_site_detector import ReadSiteDetector
+
+                read_site_detector = ReadSiteDetector(framework=framework)
+                read_origins = read_site_detector.detect_origins(func, parsed_file)
+                for ro in read_origins:
+                    self._stats["origins_identified"] += 1
+                    try:
+                        ro_origin_type = OriginType[ro.origin_type]
+                    except KeyError:
+                        ro_origin_type = OriginType.USER_INPUT
+                    propagator.add_origin(
+                        origin_type=ro_origin_type,
+                        origin_name=ro.param_name or ro.target_variable,
+                        origin_location=(ro.file_path, ro.line),
+                        entry_point_id=ep.get("id"),
+                        function_qname=handler_qname,
+                        parameter_name=ro.target_variable,
+                    )
+
+        # Run propagation
+        self._flows = propagator.propagate_all()
+
+        # Enrich each flow with sink-evidence
+        from .sink_evidence import SinkEvidenceCollector
+
+        evidence_collector = SinkEvidenceCollector(list(self._parsed_files.values()))
+        for flow in self._flows:
+            ev = evidence_collector.collect_for_flow(
+                sink_file=flow.sink_location[0],
+                sink_line=flow.sink_location[1],
+                sink_arg_index=flow.sink_argument_index,
+                sink_arg_name=flow.sink_argument_name,
+            )
+            if ev is not None:
+                flow.sink_evidence = ev
+
+        # Update statistics
+        self._stats["flows_discovered"] = len(self._flows)
+        self._stats["truncated_flows"] = sum(1 for f in self._flows if f.truncated)
+
+        prop_stats = propagator.get_statistics()
+        self._stats.update(prop_stats)
+
+        logger.info(
+            f"Data flow analysis complete: "
+            f"{self._stats['origins_identified']} origins, "
+            f"{self._stats['flows_discovered']} flows"
+        )
+
+        return self._flows
+
+    def get_statistics(self) -> dict[str, int]:
+        """Get analysis statistics."""
+        return dict(self._stats)
+
+    def to_manifest_flows(self) -> list[dict[str, Any]]:
+        """Convert flows to manifest format."""
+        from ..core.manifest import (
+            CallContextModel,
+            DataFlowModel,
+            DataOriginModel,
+            DataSinkModel,
+            FlowStepModel,
+            LocationModel,
+            TransformationModel,
+        )
+
+        result = []
+
+        for flow in self._flows:
+            path_models = [
+                FlowStepModel(
+                    depth=step.depth,
+                    caller=step.caller,
+                    callee=step.callee,
+                    argument_mapping=step.variable_mapping,
+                    location=LocationModel(
+                        file=str(step.location[0]),
+                        line=step.location[1],
+                    ),
+                )
+                for step in flow.path
+            ]
+
+            transform_models = [
+                TransformationModel(
+                    depth=t.depth if t.depth >= 0 else 0,
+                    location=LocationModel(
+                        file=str(t.location[0]),
+                        line=t.location[1],
+                    ),
+                    type=t.type,
+                    description=t.description,
+                    function=t.function,
+                    call_evidence=self._evidence_to_model(t.call_evidence),
+                )
+                for t in flow.transformations
+            ]
+
+            ctx = flow.sink_context or {}
+            context_model = CallContextModel(
+                in_try_block=ctx.get("in_try_block", False),
+                in_conditional=ctx.get("in_conditional", False),
+                in_loop=ctx.get("in_loop", False),
+            )
+
+            sink_evidence_model = self._evidence_to_model(flow.sink_evidence)
+
+            flow_model = DataFlowModel(
+                id=flow.id,
+                origin=DataOriginModel(
+                    type=flow.origin_type.name,
+                    name=flow.origin_name,
+                    location=LocationModel(
+                        file=str(flow.origin_location[0]),
+                        line=flow.origin_location[1],
+                    ),
+                    entry_point_ref=flow.entry_point_id,
+                ),
+                sink=DataSinkModel(
+                    function=flow.sink_function,
+                    argument_index=flow.sink_argument_index,
+                    argument_name=flow.sink_argument_name,
+                    location=LocationModel(
+                        file=str(flow.sink_location[0]),
+                        line=flow.sink_location[1],
+                    ),
+                    call_ref=flow.sink_call_id,
+                ),
+                path=path_models,
+                depth=flow.depth,
+                truncated=flow.truncated,
+                transformations=transform_models,
+                sink_evidence=sink_evidence_model,
+                context=context_model,
+                confidence=flow.confidence,
+            )
+
+            result.append(flow_model.model_dump())
+
+        return result
+
+    @staticmethod
+    def _evidence_to_model(evidence: Any) -> CallSiteEvidenceModel | None:  # noqa: F821
+        """Convert internal CallSiteEvidence to manifest Pydantic model."""
+        if evidence is None:
+            return None
+        from ..core.manifest import (
+            ArgumentEvidenceModel,
+            CallSiteEvidenceModel,
+            StringPatternModel,
+        )
+
+        arg_models = [
+            ArgumentEvidenceModel(
+                position=a.position,
+                name=a.name,
+                is_literal=a.is_literal,
+                literal_value=a.literal_value,
+                literal_type=a.literal_type,
+                is_variable=a.is_variable,
+                variable_name=a.variable_name,
+                is_call_result=a.is_call_result,
+                called_function=a.called_function,
+                construction=a.construction,
+                container_type=a.container_type,
+                source_variables=list(a.source_variables),
+                expression_text=a.expression_text,
+                is_tainted=a.is_tainted,
+            )
+            for a in evidence.all_arguments
+        ]
+        pattern_models = [
+            StringPatternModel(
+                type=p.pattern_type,
+                pattern=p.matched,
+                argument_position=p.argument_position,
+            )
+            for p in evidence.string_patterns
+        ]
+        return CallSiteEvidenceModel(
+            tainted_argument_position=evidence.tainted_argument_position,
+            tainted_argument_name=evidence.tainted_argument_name,
+            tainted_argument_construction=evidence.tainted_argument_construction,
+            all_arguments=arg_models,
+            string_patterns=pattern_models,
+        )
+
+
+# =============================================================================
+# Convenience Functions
+# =============================================================================
+
+
+def analyze_data_flow(
+    call_graph: CallGraph,
+    parsed_files: list[ParsedFile],
+    entry_points: list[dict[str, Any]],
+    flow_bindings: FlowSensitiveBindings | None = None,
+    max_depth: int = 10,
+) -> tuple[list[DataFlow], dict[str, int]]:
+    """
+    Convenience function to run data flow analysis.
+
+    Args:
+        call_graph: Pre-built call graph
+        parsed_files: Parsed source files
+        entry_points: List of entry points (routes)
+        flow_bindings: Optional flow-sensitive bindings
+        max_depth: Maximum propagation depth
+
+    Returns:
+        Tuple of (flows, statistics)
+    """
+    analyzer = DataFlowAnalyzer(
+        call_graph=call_graph,
+        parsed_files=parsed_files,
+        entry_points=entry_points,
+        flow_bindings=flow_bindings,
+        max_depth=max_depth,
+    )
+
+    flows = analyzer.analyze()
+    stats = analyzer.get_statistics()
+
+    return flows, stats