fix(model-grounded-detection): closure scoping, and the three bugs it uncovered

The group-4 finding: JavaScript is callback-heavy, so the method containing a
sink routinely is not the labeled function. `fs.readFileSync` inside the
callback passed to `fs.stat` has enclosing method `<lambda>0`, and filtering on
`sinkMethod == function` dropped it -- the whole path family measured 0/8.

Scope is now decided by line-range containment within the same file
(astParentFullName is empty for lambdas, so nesting is not readable there), and
reported as `inLabeledScope`; the Python side trusts that flag and keeps the
name comparison only as a fallback, so an engine that cannot report scope never
has its sinks silently treated as scoped. Parameter sources stay bound to the
labeled function's OWN parameters -- a callback's `err`/`stats` are not
attacker input.

Fixing the scope exposed three further bugs, each of which would have raised
the number while making the answer untrue:

  * Shortest-flow-wins picked the wrong witness. With closures in scope the
    same sink has flows from `req.url...` (10 steps, the vulnerability), `res`
    (3) and `this` (7). A flow whose source matches the source model now
    outranks a shorter one from a bare captured name; shortest still breaks
    ties, so the order stays total and the verdict deterministic.
  * The JS fact file had NO sanitizers at all, so no JavaScript fix of any
    family could ever be recognised. Added the documented path-normalisation
    and HTML-escaping APIs, with provenance.
  * Adding them regressed the witness, because `resolveUrl` CONTAINS `resolve`
    and the substring test marked the vulnerable flow sanitized. This is the
    same bug class already fixed in dominance.sc and not carried across -- the
    exact fix-the-instance-miss-the-class failure. taint.sc now matches on word
    boundaries too.

And the principled rule the fix turns on: parameter sources are a FALLBACK,
never an override. When a modelled source reaches the sink, those flows are the
evidence; otherwise a captured `res` reaching a sanitized sink reports the fix
as still vulnerable on a flow that names no attacker input.

Also recorded: req.url was NOT wrong as a diagnosis, it was untestable in
isolation -- the scoping bug masked it. Both were needed. On the pair that
motivated all of this:

  vuln   model_entailed      req.url.split('?')[0] -> readFileSync(possibleFilename)
  fixed  model_corroborated  same flow, sanitized by path.normalize
  distinguished: true

700 passing, mypy/ruff clean, gates byte-identical.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

src/openultrasast/ruleset/semantic/javascript.toml

@@ -28,6 +28,17 @@ id = "parameterized_query"
 calls = ["query", "execute"]
 parameterized = true
 
+# --- model-grounded-detection: raw-Node request sources -------------------------------------------------
+# The shipped `req` source fact carries the Express idioms (req.query, req.body, req.params). A raw Node
+# http server -- which is what a static file server is -- reads the path straight off `req.url`
+# (http.IncomingMessage.url), and `url.parse(req.url)` is the documented way to split it. Measured need:
+# with these absent, the angular-http-server path-traversal pair resolved its flow to the captured `res`
+# rather than to attacker input, because no modelled source matched.
+
+[[source]]
+id = "node-request"
+patterns = ["req.url", "request.url", "req.rawHeaders", "url.parse", "parsedUrl"]
+
 # --- model-grounded-detection task 4.2 -------------------------------------------------------------------
 # See the note in python.toml: documented dangerous APIs, provenance per entry, reviewed as data.
 
@@ -65,3 +76,19 @@ id = "redirect"
 cwe = "CWE-601"
 calls = ["redirect", "location.assign", "location.replace"]
 rule_ids = []
+
+# --- model-grounded-detection: sanitizers -----------------------------------------------------------------
+# This file shipped with no [[sanitizer]] entries at all, so no JavaScript fix of any family could be
+# recognised and the model entailed a fixed twin exactly as readily as its vulnerable one. Measured on the
+# angular-http-server path-traversal pair, whose fix is precisely `path.normalize(...).replace(/^(\.\.[\/\\])+/, '')`.
+# Documented normalising / escaping APIs, provenance per entry, reviewed as data.
+
+[[sanitizer]]
+# CWE-22. Node's documented path normalisation; `resolve` and `join` against a fixed base collapse `..`.
+id = "path.normalize"
+calls = ["path.normalize", "path.resolve"]
+
+[[sanitizer]]
+# CWE-79. The standard encoders: the DOM/global URI encoders and the common escaping helpers.
+id = "html.escape"
+calls = ["encodeURIComponent", "encodeURI", "escapeHtml", "escape", "sanitizeHtml", "DOMPurify.sanitize"]