/** * SinkFilterPass * * Applies the four-stage sink filtering pipeline to eliminate false positives, * followed by language-specific XPath/XSS suppression. * * Filter stages (applied in order): * 1. Dead code — remove sinks on unreachable lines * 2. Clean array elements — strong updates via constant propagation * 3. Clean variables — arguments proven non-tainted by constant propagation * 4. Sanitized sinks — sinks wrapped by a recognised sanitizer call * 5. Python XPath FP reduction * 6. JavaScript setAttribute FP reduction (safe attribute names) * 7. JavaScript XSS FP reduction * * Depends on: taint-matcher, constant-propagation, language-sources */ import type { TaintSource, TaintSink, TaintSanitizer } from '../../types/index.js'; import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js'; export interface SinkFilterResult { /** Merged sources: taint-matcher + language-sources. */ sources: TaintSource[]; /** Filtered sinks. */ sinks: TaintSink[]; sanitizers: TaintSanitizer[]; } export declare class SinkFilterPass implements AnalysisPass { readonly name = "sink-filter"; readonly category: "security"; run(ctx: PassContext): SinkFilterResult; } import type { CircleIR } from '../../types/index.js'; type Symbols = Map; export declare function filterCleanVariableSinks(sinks: CircleIR['taint']['sinks'], calls: CircleIR['calls'], taintedVars: Set, symbols: Symbols, dfg?: CircleIR['dfg'], sanitizedVars?: Set, synchronizedLines?: Set, language?: string): CircleIR['taint']['sinks']; export declare function filterSanitizedSinks(sinks: CircleIR['taint']['sinks'], sanitizers: CircleIR['taint']['sanitizers'], calls: CircleIR['calls']): CircleIR['taint']['sinks']; export {}; //# sourceMappingURL=sink-filter-pass.d.ts.map