/**
 * Pass #91: spring4shell (category: security, CWE-94)
 *
 * Detects the Spring4Shell (CVE-2022-22965) data-binding RCE pattern in
 * Spring MVC controllers. The vulnerable shape is a controller handler
 * method that takes a complex POJO parameter without an explicit binding
 * annotation:
 *
 *   @Controller
 *   public class Foo {
 *     @RequestMapping("/bar")
 *     public String bar(MyBean bean) { ... }   // implicit form-data binding
 *   }
 *
 * Spring's WebDataBinder walks the parameter's class graph and populates
 * setters from request parameters using reflection. CVE-2022-22965 abuses
 * this chain (`class.module.classLoader.resources.context...`) to write
 * attacker-controlled values into the Tomcat AccessLogValve and achieve
 * RCE. The vulnerability is mitigated by:
 *   - Using `@RequestBody` (JSON binding via Jackson, no DataBinder)
 *   - Using `@RequestParam` / `@PathVariable` (scalar binding only)
 *   - Restricting bindable fields via `@InitBinder` + `setAllowedFields`
 *
 * This pass is a PATTERN PASS (not a taint pass): it inspects controller
 * method signatures directly. The existing `code-injection` pass (#11)
 * already covers explicit `DataBinder.bind()` / `DataBinder.setPropertyValues()`
 * sink calls — Spring4Shell-vulnerable code typically does NOT make those
 * calls (Spring does it implicitly), so a taint flow alone misses it.
 *
 * False-positive control:
 *   - Only fires when the class is a Spring MVC controller (@Controller,
 *     @RestController, or @ControllerAdvice).
 *   - Only fires on methods with a route annotation (@RequestMapping or
 *     @GetMapping / @PostMapping / @PutMapping / @DeleteMapping /
 *     @PatchMapping).
 *   - Only fires on parameters with NO binding annotation. Any
 *     @RequestBody / @RequestParam / @PathVariable / @ModelAttribute /
 *     @RequestHeader / @CookieValue / @MatrixVariable / @Valid /
 *     @Validated on the parameter suppresses the finding.
 *   - Skips framework parameter types (HttpServletRequest, Model,
 *     Principal, MultipartFile, etc.) where Spring resolves the value
 *     directly without form-data binding.
 *   - Skips primitives, boxed primitives, String, and standard collection
 *     types (those use scalar conversion, not WebDataBinder).
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface Spring4ShellPassResult {
    /** Number of controller methods inspected. */
    controllerMethodsScanned: number;
    /** Number of findings emitted. */
    findingsEmitted: number;
}
export declare class Spring4ShellPass implements AnalysisPass<Spring4ShellPassResult> {
    readonly name = "spring4shell";
    readonly category: "security";
    run(ctx: PassContext): Spring4ShellPassResult;
}
//# sourceMappingURL=spring4shell-pass.d.ts.map