NoirAIContext::Builder

Sink kinds whose callee names are words a project reuses for its own helpers (render, unserialize). The other kinds keep the name match: their catalogs miss common body forms (Python open(, Django HttpResponseRedirect), so judging a helper's body would drop real ones.

A Kotlin companion object belongs to its class: a bare call reaches it.

Capture 1 is the bare-key noun, capture 3 the quoted-key noun; exactly one of them is set per match.

Sensitive-response detection runs as a two-step check on the route-scope snippet:

1. RESPONSE_EMITTER_PATTERN — the snippet serializes a response, either through a helper (res.json, jsonify, render json:, to_json, …) or by returning a literal (return {...}).
2. CREDENTIAL_KEY_IN_RESPONSE — the snippet also has a credential noun as a key, in either of the two spellings a response literal uses: bare — { token: … } (JS/TS shorthand, Ruby, YAML) quoted — { "token": … } (JSON, Python dicts, Go maps, PHP arrays, any serialized body)

Both have to match in the same scope. The earlier single-regex version was too loose and caught english prose mentioning credentials in response strings, so the fix required the noun not be preceded by a quote. That over-corrected: it also excluded every quoted key, which is the dominant shape in most languages, and the signal quietly stopped firing on them.

The two branches below keep the original guard for bare keys while admitting quoted ones, and stay narrow because the quoted branch requires the string to close immediately after the noun. { message: "Set X-API-KEY header" } still doesn't fire — the noun sits mid-string, so no closing quote follows it.

Some analyzers (express's loose destructuring, Java route extractors that don't follow @RequestBody Credentials c.password, …) miss credential-bearing parameters at extract time. When that happens the param-based credential_input signal never fires and downstream heuristics like rate_limit_absence silently skip the route.

As a backstop, scan the route-scope snippet for the canonical request-body destructuring shapes (req.body.password, request.form['password'], { password } = req.body, …) and emit a credential_input signal with a slightly lower confidence than the param-based one. The kind is the same so downstream rate_limit_absence / guard_absence logic catches it transparently.

Every call in a helper body: an optional receiver (torch, $smarty, none after )), the operator, and the called name.

What a helper's body does when it renders or revives, beyond the kind's own catalog: Django render_to_string, Go tpls.ExecuteTemplate(w, ...), Thymeleaf engine.process(view, c), a PHP include of a variable view path; from pickle import loads + bare loads(d), yaml.unsafe_load, cloudpickle.loads, pickle.Unpickler(...).load(), Ruby Marshal.restore. Body-only: the callee-name catalog stays as narrow as it was.

Resolved once from the catalog instead of re-scanning PARAM_PATTERNS on every call. identifier_like? in particular runs several times per parameter per endpoint, and the answer never changes.

Lines that bring names in from elsewhere: Python from x import a as render, import / use statements, require(...).

Log injection / sensitive data in logs. Catches the canonical "log user input or credential field directly" shape. False positives are bounded because both the log call AND a user- input reference (or credential noun) need to be on the same line / snippet window.

Suppression for unsafe_method: route handlers that branch on request.method (Flask / Django) or req.method (Express, Node, Go's r.Method, Java's request.getMethod()) typically register a single route under multiple methods. Analyzers split that into one endpoint per method but share the callees list. The mutating callee in the GET endpoint is often the POST branch's call, not actually reachable via GET.

Each verb may be followed by additional word chars (destroy_all, createMany, deleteOne, updateUser), so we don't anchor with a trailing \b — that would miss those suffixed forms because _ and word continuation count as the same word in regex.

A mutating verb anywhere in the callee name (start, after a separator, or as a CamelCase segment) disqualifies the endpoint from "read-only POST". Without this, a callee like getOrCreate/findAndDelete matches the read-only pattern via its leading read verb, silently suppressing the state-change review signal on an endpoint that does mutate.

Extensions where a bare call reaches a method of the caller's own class (Kotlin render(id) inside the controller, a Ruby private method). Elsewhere a bare name is a module-level function.

@PostAuthorize(...) up to the scope's next line: Spring evaluates it after the handler returns, so on a write it guards nothing.

Categories whose mere presence is a security-review signal — used alongside concrete signals to compute the overall priority bucket.

Receivers whose mutating-named methods touch only a local value: a URL or search-param bag (params.delete, redirSearchParams.delete), headers, a bare Map/Set, a hash module, and a hash/HMAC built by a call (crypto.createHash().update(), hashlib.sha256().update). Case-sensitive: Url.create and Digest.create are model classes.

ponytail: name-only guess for receiverless text helpers (remove_links, remove_playground_links); resolve the callee's definition if more of these turn up.

The emitter list was built from helper calls (jsonify, res.json, …) and so missed the frameworks that serialize a returned literal with no helper at all: FastAPI and modern Flask handlers just return {...}, which is the single most common response shape in the Python corpus. Without it the credential-key check could not run on those handlers no matter what the payload held.

Concrete review-worthy signal kinds. These are the "this is actually scary" categories — not the structural ones (route_definition, technology, path_param) that every endpoint surfaces.

A route path written as a constant, a qualified name, a literal or a symbol; a list of them (@GetMapping({A, B})); and a handler string after it (Rails get 'authorize' => 'oauth#authorize', Laravel Route::get('authorize', 'OAuthController@authorize')).

The first argument of the route's own verb or mapping call: its path, written as a constant (@GetMapping(AUTHORIZE_PATH)) or as a segment without a leading / (Grape post 'authorize' do). Only the first argument: a middleware passed after it (router.get('/x', authenticate, h)) is a guard. ponytail: first positional (or value =/path =) argument only; @RequestMapping(method = GET, value = X) is not masked.

Receivers whose loads / decode revive no objects: the JSON modules, byte codecs, and a name bound in the body to itsdangerous' signed-JSON serializers (CTFd: s = URLSafeTimedSerializer(secret) then s.loads(...)). Ruby's JSON.load / JSON.restore are the exception: they honour create_additions and revive objects.

HTTP method intent vs implementation mismatch. A GET/HEAD endpoint that mutates server state through a callee (User.create, record.destroy, db.delete, …) is a textbook CSRF / side-effect-on-read bug — the verb says "safe / idempotent" but the code says otherwise. QUERY makes the same promise (RFC 10008 defines it safe + idempotent), so a mutating QUERY handler earns the same signal. The shared set keeps this file, the taggers, and the probe path-filler agreeing on what a read is.

User.select("#{params[:col]}"), SQLAlchemy select(text(request.args["c"])): a select whose argument is built at run time is SQL whatever the receiver. A fixed column list (User.select(*attrs)) stays out, and so do a lambda or block argument (LINQ _items.Select(x => x.Name + ""), Ruby select(&:active?), JS .select((x) => "#" + x)) and a data frame's column pick (polars df.select(f"col_{i}")).

This check needs the response emitter and the credential key in the same window, and in real handlers they sit far apart — the body assembles a dict/struct first and serializes it at the end. Under the default 12-line / 240-char route scope the two could not co-occur, so the signal never fired on the shape it exists to catch. Widen the window for this check only; the scope walk still stops at the end of the handler, so it cannot pair one route's emitter with another route's payload.

A call in a helper's body the judge cannot follow but that may well be the render / revive, by the call's last segment, qualified or not (torch.load(b), Oj.load, $smarty->display($tpl), ERB.new(src).result(binding), cfg.getTemplate(n).process(m, out)): such a helper keeps its sink.

SOAP transports every operation over POST. Treat read-style operation names as reads so HTTP method heuristics do not label them as mutations.

A callee changes state when one of its chain segments is a mutating verb whose immediate receiver is not a known pure value. Judging the segment with its receiver keeps crypto.createHash().update().digest and params.delete('debug') out while User.destroy, db.session.commit and doc.set().save stay in.