/** * InterproceduralPass * * Performs inter-procedural taint analysis: finds taint escaping the current * method into callees and surfaces sinks inside those callees. * * Handles two scenarios: * A) Sources + sinks already found → find additional sinks inside callees * and generate inter-procedural flows between them. * B) Sources found but no sinks yet → detect external taint escapes * (CWE-668 "external_taint_escape") as a fallback. * * Depends on: sink-filter, constant-propagation, taint-propagation */ import type { TaintSink, TaintFlowInfo, InterproceduralInfo } from '../../types/index.js'; import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js'; export interface InterproceduralPassResult { /** Additional sinks surfaced by inter-procedural analysis. */ additionalSinks: TaintSink[]; /** Additional flows generated from inter-procedural paths. */ additionalFlows: TaintFlowInfo[]; /** Structured inter-procedural summary for the IR output. */ interprocedural?: InterproceduralInfo; } /** * Constructor options for InterproceduralPass. * * Wired from `AnalyzerOptions.enableEntryPointGate` in `analyze()`. * See the JSDoc on that field for full semantics. */ export interface InterproceduralOptions { /** * Mirror of `AnalyzerOptions.enableEntryPointGate`. Default `true`. * * When `true` (the default and pre-3.95.0 always-on behaviour), the * Tier 1/2/3 entry-point classifier suppresses `interprocedural_param` * sources whose enclosing Java method is a library-API surface not * reachable from a recognised entry point. * * Set `false` to disable the gate and surface the un-gated source set * (cognium-dev#137, 3.95.0). */ enableEntryPointGate?: boolean; } export declare class InterproceduralPass implements AnalysisPass { readonly name = "interprocedural"; readonly category: "security"; private readonly enableEntryPointGate; constructor(options?: InterproceduralOptions); run(ctx: PassContext): InterproceduralPassResult; } //# sourceMappingURL=interprocedural-pass.d.ts.map