Structural taint engine: per-method scope-aware reachability

ober

b6f9e3cfe74ed63d30290ec4e22e282993885d0d

diff --git a/lib/semgrep/scan.sls b/lib/semgrep/scan.sls
index ce2dff2..d348915 100644
--- a/lib/semgrep/scan.sls
+++ b/lib/semgrep/scan.sls
@@ -31850,18 +31850,20 @@
        (let* ([line (finding-start-line finding)]
               [target-line (source-line source line)]
               [target-indent (line-indent target-line)])
-         (if (= target-indent 0)
-             (and (simple-function-scope-line? target-line) line)
-             (let loop ([current-line (- line 1)])
-               (cond
-                 [(< current-line 1) #f]
-                 [else
-                  (let* ([text (source-line source current-line)]
-                         [indent (line-indent text)])
-                    (if (and (< indent target-indent)
-                             (simple-function-scope-line? text))
-                        current-line
-                        (loop (- current-line 1))))])))))
+         (cond
+           [(simple-function-scope-line? target-line) line]
+           [(= target-indent 0) #f]
+           [else
+            (let loop ([current-line (- line 1)])
+              (cond
+                [(< current-line 1) #f]
+                [else
+                 (let* ([text (source-line source current-line)]
+                        [indent (line-indent text)])
+                   (if (and (< indent target-indent)
+                            (simple-function-scope-line? text))
+                       current-line
+                       (loop (- current-line 1))))]))])))
   (def (same-simple-function-scope? source a b)
        (let ([a-scope (finding-simple-function-scope source a)]
              [b-scope (finding-simple-function-scope source b)])
diff --git a/src/semgrep/scan.ss b/src/semgrep/scan.ss
index a9cc6d3..953ff74 100644
--- a/src/semgrep/scan.ss
+++ b/src/semgrep/scan.ss
@@ -31800,9 +31800,14 @@
     (let* ([line (finding-start-line finding)]
            [target-line (source-line source line)]
            [target-indent (line-indent target-line)])
-      (if (= target-indent 0)
-        (and (simple-function-scope-line? target-line) line)
-        (let loop ([current-line (- line 1)])
+      (cond
+        ;; The finding is ON a function signature line (e.g. a method parameter):
+        ;; that line is its scope. Without this a parameter source has no scope
+        ;; and reaches sinks in every method (cross-method false positives).
+        [(simple-function-scope-line? target-line) line]
+        [(= target-indent 0) #f]
+        [else
+         (let loop ([current-line (- line 1)])
           (cond
             [(< current-line 1) #f]
             [else
@@ -31811,7 +31816,7 @@
                (if (and (< indent target-indent)
                         (simple-function-scope-line? text))
                    current-line
-                   (loop (- current-line 1))))])))))
+                   (loop (- current-line 1))))]))])))
 
 (def (same-simple-function-scope? source a b)
   (let ([a-scope (finding-simple-function-scope source a)]