Handoff: overfit paydown across java/scala/php/kotlin; remaining = deep taint/FQN
ober
d890b845a46b6e2e0010bccead9e5e0077277bee
--- a/HANDOFF_OPUS_4_8.md +++ b/HANDOFF_OPUS_4_8.md @@ -163,10 +163,27 @@ languages, so closing them is the tip of the larger work: string args (so the pattern-not fires). `scan-java-patterns-rule` is now reduced to a single clause (`metavariable-resolution-test`, which needs FQN resolution Foo->org.foo.Foo). - STILL handler-side (the deep remaining work): java TAINT (`scan-java-taint-rule` - — real dataflow, incl. type-aware assume-safe, best-fit-sink, lambda/getter - propagators), java FQN resolution, and the analogous handlers for the other - migrated languages. The dart taint smoke cases hit the same taint gap. + + Then measured + trimmed the other migrated languages' patterns-rule handlers + (each clause kept only if disabling the handler regresses a fixture): + - **scala**: `scan-scala-patterns-rule` DELETED entirely (0 fixtures needed it). + - **php**: dropped string-eq-type + new-class-pattern sub-rules (4 of 6 kept: + metavar-call, metavar-call-case, fake-toks, non-primitive-type). + - **kotlin**: dropped response-writer sub-rule (only named-ellipsis kept). + - **go / rust**: already minimal — every remaining clause is a genuinely-hard + case (go: cp_subtraction1 constant-folding, struct_tags, typed-metavar-regex, + metavar_comparison_str, regression_uniq_or_ellipsis; rust: macro-call, + typed-metavar-not). + All validated by targeted normalize comparison + smoke 321/321. + + STILL handler-side (the deep remaining work, all genuinely hard): + - **TAINT** for every language (`scan-{lang}-taint-rule`) — needs a real + dataflow engine (type-aware assume-safe, best-fit-sink, lambda/getter + propagators, dead-catch reachability). This is the biggest remaining chunk + and what blocks dart + the java/scala/etc. taint fixtures. + - **FQN resolution** (java metavariable-resolution-test: Foo -> org.foo.Foo). + - a few per-language pattern hard-cases (go constant-folding/struct_tags, php + metavar-call/non-prim-type, rust macro-call, kotlin named-ellipsis). The original concern below (regex matcher limitations) still applies only to the languages still on `generic-language?`: `generic-language?`