feat(analyzer): Add $* star operator

core/opentaint-configuration-rules/configuration-rules-common/src/main/kotlin/org/opentaint/dataflow/configuration/TaintCleanReach.kt

@@ -0,0 +1,6 @@
+package org.opentaint.dataflow.configuration
+
+enum class TaintCleanReach {
+    Exact,
+    ExactAndAnyField,
+}

core/opentaint-configuration-rules/configuration-rules-go/src/main/kotlin/org/opentaint/dataflow/configuration/go/serialized/GoSerializedAction.kt

@@ -31,10 +31,25 @@ sealed interface GoSerializedAssignAction : GoSerializedAction {
     }
 }
 
-data class GoSerializedCleanAction(
-    val taintKind: String? = null,
-    val pos: PositionBaseWithModifiers,
-) : GoSerializedAction
+sealed interface GoSerializedCleanAction : GoSerializedAction {
+    val taintKind: String?
+    val pos: PositionBaseWithModifiers
+
+    data class Direct(
+        override val taintKind: String? = null,
+        override val pos: PositionBaseWithModifiers,
+    ) : GoSerializedCleanAction
+
+    data class AnyAccessor(
+        override val taintKind: String? = null,
+        override val pos: PositionBaseWithModifiers,
+    ) : GoSerializedCleanAction
+
+    companion object {
+        operator fun invoke(taintKind: String? = null, pos: PositionBaseWithModifiers): GoSerializedCleanAction =
+            Direct(taintKind, pos)
+    }
+}
 
 data class GoSerializedPassAction(
     val taintKind: String? = null,

core/opentaint-configuration-rules/configuration-rules-jvm/src/main/kotlin/org/opentaint/dataflow/configuration/jvm/TaintAction.kt

@@ -2,6 +2,7 @@ package org.opentaint.dataflow.configuration.jvm
 
 import org.opentaint.dataflow.configuration.CommonTaintAction
 import org.opentaint.dataflow.configuration.CommonTaintAssignAction
+import org.opentaint.dataflow.configuration.TaintCleanReach
 
 sealed interface Action: CommonTaintAction
 
@@ -28,4 +29,5 @@ data class RemoveAllMarks(
 data class RemoveMark(
     val mark: TaintMark,
     val position: Position,
+    val reach: TaintCleanReach = TaintCleanReach.Exact,
 ) : Action

core/opentaint-configuration-rules/configuration-rules-jvm/src/main/kotlin/org/opentaint/dataflow/configuration/jvm/serialized/SerializedAction.kt

@@ -1,6 +1,7 @@
 package org.opentaint.dataflow.configuration.jvm.serialized
 
 import kotlinx.serialization.Serializable
+import org.opentaint.dataflow.configuration.TaintCleanReach
 
 sealed interface SerializedAction
 
@@ -15,6 +16,7 @@ data class SerializedTaintAssignAction(
 data class SerializedTaintCleanAction(
     val taintKind: String? = null,
     val pos: PositionBaseWithModifiers,
+    val reach: TaintCleanReach = TaintCleanReach.Exact,
 ): SerializedAction
 
 @Serializable

core/opentaint-configuration-rules/configuration-rules-jvm/src/main/kotlin/org/opentaint/dataflow/configuration/jvm/serialized/SerializedCondition.kt

@@ -6,6 +6,7 @@ import com.charleskorn.kaml.YamlNode
 import com.charleskorn.kaml.YamlScalar
 import kotlinx.serialization.DeserializationStrategy
 import kotlinx.serialization.KSerializer
+import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.descriptors.PrimitiveKind
 import kotlinx.serialization.descriptors.PrimitiveSerialDescriptor
@@ -141,6 +142,13 @@ sealed interface SerializedCondition {
         val pos: PositionBaseWithModifiers,
     ): SerializedCondition
 
+    @Serializable
+    data class ContainsMarkOnAnyField(
+        @SerialName("taintedOnAnyField")
+        val tainted: String,
+        val pos: PositionBaseWithModifiers,
+    ): SerializedCondition
+
     @Serializable
     data class NumberOfArgs(val numberOfArgs: Int): SerializedCondition
 
@@ -223,6 +231,7 @@ class SerializedConditionSerializer :
     companion object {
         private val serializerByProperty = mapOf(
             "tainted" to SerializedCondition.ContainsMark.serializer(),
+            "taintedOnAnyField" to SerializedCondition.ContainsMarkOnAnyField.serializer(),
             "anyOf" to SerializedCondition.Or.serializer(),
             "allOf" to SerializedCondition.And.serializer(),
             "not" to SerializedCondition.Not.serializer(),

core/opentaint-dataflow-core/opentaint-dataflow/src/main/kotlin/org/opentaint/dataflow/ap/ifds/MethodAnalyzer.kt

@@ -10,7 +10,6 @@ import org.opentaint.dataflow.ap.ifds.MethodAnalyzer.FactToFactSub
 import org.opentaint.dataflow.ap.ifds.MethodAnalyzer.MethodCallHandler
 import org.opentaint.dataflow.ap.ifds.MethodAnalyzer.MethodCallResolutionFailureHandler
 import org.opentaint.dataflow.ap.ifds.MethodSummaryEdgeApplicationUtils.SummaryEdgeApplication
-import org.opentaint.dataflow.ap.ifds.MethodSummaryEdgeApplicationUtils.SummaryEdgeApplication.SummaryExclusionRefinement
 import org.opentaint.dataflow.ap.ifds.access.ApManager
 import org.opentaint.dataflow.ap.ifds.access.FinalFactAp
 import org.opentaint.dataflow.ap.ifds.access.InitialFactAp
@@ -1242,7 +1241,10 @@ class NormalMethodAnalyzer(
                         ndSummaryInitial.isEmpty() -> {
                             summaryHandler.handleZeroToFact(
                                 currentEdgeFactAp,
-                                SummaryExclusionRefinement(ExclusionSet.Universe),
+                                SummaryEdgeApplication(
+                                    accessDelta = null,
+                                    initialFactExclusions = ExclusionSet.Universe,
+                                ),
                                 summaryEdge.summaryEdge()
                             )
                         }
@@ -1252,7 +1254,10 @@ class NormalMethodAnalyzer(
                             summaryHandler.handleFactToFact(
                                 initialFact,
                                 currentEdgeFactAp,
-                                SummaryExclusionRefinement(initialFact.exclusions),
+                                SummaryEdgeApplication(
+                                    accessDelta = null,
+                                    initialFactExclusions = initialFact.exclusions,
+                                ),
                                 summaryEdge.summaryEdge()
                             )
                         }
@@ -1261,7 +1266,10 @@ class NormalMethodAnalyzer(
                             summaryHandler.handleNDFactToFact(
                                 ndSummaryInitial,
                                 currentEdgeFactAp,
-                                SummaryExclusionRefinement(ExclusionSet.Universe),
+                                SummaryEdgeApplication(
+                                    accessDelta = null,
+                                    initialFactExclusions = ExclusionSet.Universe,
+                                ),
                                 summaryEdge.summaryEdge()
                             )
                         }
@@ -1275,7 +1283,10 @@ class NormalMethodAnalyzer(
                                 summaryHandler.handleFactToFact(
                                     currentEdge.initialFactAp,
                                     currentEdgeFactAp,
-                                    SummaryExclusionRefinement(currentEdge.initialFactAp.exclusions),
+                                    SummaryEdgeApplication(
+                                        accessDelta = null,
+                                        initialFactExclusions = currentEdge.initialFactAp.exclusions,
+                                    ),
                                     summaryEdge.summaryEdge()
                                 )
                             }
@@ -1284,7 +1295,10 @@ class NormalMethodAnalyzer(
                                 summaryHandler.handleNDFactToFact(
                                     ndSummaryInitial,
                                     currentEdgeFactAp,
-                                    SummaryExclusionRefinement(ExclusionSet.Universe),
+                                    SummaryEdgeApplication(
+                                        accessDelta = null,
+                                        initialFactExclusions = ExclusionSet.Universe,
+                                    ),
                                     summaryEdge.summaryEdge()
                                 )
                             }
@@ -1295,7 +1309,10 @@ class NormalMethodAnalyzer(
                         summaryHandler.handleNDFactToFact(
                             ndSummaryInitial + currentEdge.initialFacts,
                             currentEdgeFactAp,
-                            SummaryExclusionRefinement(ExclusionSet.Universe),
+                            SummaryEdgeApplication(
+                                accessDelta = null,
+                                initialFactExclusions = ExclusionSet.Universe,
+                            ),
                             summaryEdge.summaryEdge()
                         )
                     }
@@ -1882,4 +1899,4 @@ private class TaintMarkGatherer: FactTypeChecker.FactApFilter {
             else -> FactTypeChecker.FilterResult.FilterNext(this)
         }
     }
-}
+}

core/opentaint-dataflow-core/opentaint-dataflow/src/main/kotlin/org/opentaint/dataflow/ap/ifds/MethodSummaryEdgeApplicationUtils.kt

@@ -4,9 +4,20 @@ import org.opentaint.dataflow.ap.ifds.access.FinalFactAp
 import org.opentaint.dataflow.ap.ifds.access.InitialFactAp
 
 object MethodSummaryEdgeApplicationUtils {
-    sealed interface SummaryEdgeApplication {
-        data class SummaryApRefinement(val delta: FinalFactAp.Delta) : SummaryEdgeApplication
-        data class SummaryExclusionRefinement(val exclusion: ExclusionSet) : SummaryEdgeApplication
+    /**
+     * The two independent refinements selected while matching a summary edge.
+     *
+     * [accessDelta] belongs to the access-path representation. [initialFactExclusions] belongs to
+     * demand analysis and is present only for an empty access delta. Synthetic ND applications
+     * may supply only [initialFactExclusions].
+     */
+    data class SummaryEdgeApplication(
+        val accessDelta: FinalFactAp.Delta?,
+        val initialFactExclusions: ExclusionSet?,
+    ) {
+        init {
+            require(accessDelta != null || initialFactExclusions != null)
+        }
     }
 
     fun tryApplySummaryEdge(
@@ -15,11 +26,16 @@ object MethodSummaryEdgeApplicationUtils {
     ): List<SummaryEdgeApplication> =
         methodInitialFactAp.delta(methodSummaryInitialFactAp).map { delta ->
             if (delta.isEmpty) {
-                SummaryEdgeApplication.SummaryExclusionRefinement(
-                    methodInitialFactAp.exclusions.union(methodSummaryInitialFactAp.exclusions)
+                SummaryEdgeApplication(
+                    accessDelta = delta,
+                    initialFactExclusions =
+                        methodInitialFactAp.exclusions.union(methodSummaryInitialFactAp.exclusions),
                 )
             } else {
-                SummaryEdgeApplication.SummaryApRefinement(delta)
+                SummaryEdgeApplication(
+                    accessDelta = delta,
+                    initialFactExclusions = null,
+                )
             }
         }
 

core/opentaint-dataflow-core/opentaint-dataflow/src/main/kotlin/org/opentaint/dataflow/ap/ifds/access/AnyFieldMarkExclusions.kt

@@ -0,0 +1,160 @@
+package org.opentaint.dataflow.ap.ifds.access
+
+import org.opentaint.dataflow.ap.ifds.ExclusionSet
+import org.opentaint.dataflow.ap.ifds.access.util.AccessorIdx
+
+/**
+ * Marks excluded from future materialization of an AnyField abstraction.
+ *
+ * An AnyField cleaner removes every currently materialized matching mark and records here what
+ * must remain excluded if the fact later grows. Tree stores the value on abstract nodes; Automata
+ * and Cactus store it on their final access values. Initial facts never carry it.
+ *
+ * Each mark carries the minimum relative depth below the AnyField at which it is excluded:
+ *
+ *  - [marksFromDepth1] applies to a direct mark child and everything deeper.
+ *  - [marksFromDepth2] preserves a direct mark child and applies after one intervening accessor.
+ *
+ * Arrays are sorted and disjoint. [create] returns `null` for an empty tree annotation; root-only
+ * representations use [Empty] as their explicit neutral value.
+ */
+class AnyFieldMarkExclusions private constructor(
+    @JvmField val marksFromDepth1: IntArray,
+    @JvmField val marksFromDepth2: IntArray,
+) {
+    private val hash: Int = marksFromDepth1.contentHashCode() * 31 + marksFromDepth2.contentHashCode()
+
+    override fun hashCode(): Int = hash
+
+    override fun equals(other: Any?): Boolean {
+        if (this === other) return true
+        if (other !is AnyFieldMarkExclusions) return false
+        if (hash != other.hash) return false
+        return marksFromDepth1.contentEquals(other.marksFromDepth1)
+            && marksFromDepth2.contentEquals(other.marksFromDepth2)
+    }
+
+    operator fun contains(mark: AccessorIdx): Boolean =
+        marksFromDepth1.binarySearch(mark) >= 0 || marksFromDepth2.binarySearch(mark) >= 0
+
+    val isEmpty: Boolean
+        get() = marksFromDepth1.isEmpty() && marksFromDepth2.isEmpty()
+
+    /** A base-level any-field clean starts applying below one concrete accessor. */
+    fun add(mark: AccessorIdx): AnyFieldMarkExclusions = addMarkFromDepth2(mark)
+
+    internal infix fun then(other: AnyFieldMarkExclusions): AnyFieldMarkExclusions =
+        then(this, other) ?: Empty
+
+    internal infix fun join(other: AnyFieldMarkExclusions): AnyFieldMarkExclusions =
+        join(this, other) ?: Empty
+
+    private fun allMarks(): IntArray = (marksFromDepth1 + marksFromDepth2).also { it.sort() }
+
+    /**
+     * The claim as seen from any position at least one accessor below the annotated node:
+     * everything below such a position is at depth >= 2 relative to the annotated node, so every
+     * claimed mark — depth-1 and depth-2 alike — applies from relative depth 1 there.
+     */
+    fun collapseToDepth1(): AnyFieldMarkExclusions =
+        if (marksFromDepth2.isEmpty()) this else AnyFieldMarkExclusions(allMarks(), EMPTY)
+
+    override fun toString(): String = buildString {
+        append("!*{d1=")
+        append(marksFromDepth1.joinToString(","))
+        append(";d2=")
+        append(marksFromDepth2.joinToString(","))
+        append("}")
+    }
+
+    companion object {
+        private val EMPTY = IntArray(0)
+        val Empty = AnyFieldMarkExclusions(EMPTY, EMPTY)
+
+        /**
+         * [marksFromDepth1] and [marksFromDepth2] must each be sorted; a mark present in both is
+         * kept at depth 1. Alternative executions must instead combine through [join], which
+         * resolves the conflict in the weaker direction.
+         */
+        fun create(marksFromDepth1: IntArray, marksFromDepth2: IntArray): AnyFieldMarkExclusions? {
+            val d2 = if (marksFromDepth2.any { marksFromDepth1.binarySearch(it) >= 0 }) {
+                marksFromDepth2.filter { marksFromDepth1.binarySearch(it) < 0 }.toIntArray()
+            } else {
+                marksFromDepth2
+            }
+
+            if (marksFromDepth1.isEmpty() && d2.isEmpty()) return null
+            return AnyFieldMarkExclusions(marksFromDepth1, d2)
+        }
+
+        private fun fromDepth1(mark: AccessorIdx): AnyFieldMarkExclusions = AnyFieldMarkExclusions(intArrayOf(mark), EMPTY)
+
+        private fun fromDepth2(mark: AccessorIdx): AnyFieldMarkExclusions = AnyFieldMarkExclusions(EMPTY, intArrayOf(mark))
+
+        fun AnyFieldMarkExclusions?.addMarkFromDepth1(mark: AccessorIdx): AnyFieldMarkExclusions {
+            if (this == null) return fromDepth1(mark)
+            if (marksFromDepth1.binarySearch(mark) >= 0) return this
+            // depth 1 is the stronger claim: it absorbs a depth-2 entry for the same mark
+            val d1 = (marksFromDepth1 + mark).also { it.sort() }
+            val d2 = if (marksFromDepth2.binarySearch(mark) >= 0) {
+                marksFromDepth2.filter { it != mark }.toIntArray()
+            } else {
+                marksFromDepth2
+            }
+            return AnyFieldMarkExclusions(d1, d2)
+        }
+
+        fun AnyFieldMarkExclusions?.addMarkFromDepth2(mark: AccessorIdx): AnyFieldMarkExclusions {
+            if (this == null) return fromDepth2(mark)
+            if (contains(mark)) return this
+            val d2 = (marksFromDepth2 + mark).also { it.sort() }
+            return AnyFieldMarkExclusions(marksFromDepth1, d2)
+        }
+
+        /**
+         * The join of two alternative executions meeting at the SAME abstract node: a mark
+         * survives only when both alternatives exclude it, and at the weaker of the two depths
+         * (max — a claim both alternatives make only from depth 2 cannot be strengthened to
+         * depth 1).
+         *
+         * The abstraction state itself joins with "not abstract" as the identity: when only one
+         * operand is abstract, all abstraction (and its annotation) comes from that operand —
+         * callers handle that case and reach here only with two abstract operands.
+         */
+        fun join(a: AnyFieldMarkExclusions?, b: AnyFieldMarkExclusions?): AnyFieldMarkExclusions? {
+            if (a == null || b == null) return null
+            if (a == b) return a
+
+            val d1 = a.marksFromDepth1.filter { b.marksFromDepth1.binarySearch(it) >= 0 }.toIntArray()
+            val d2 = mutableListOf<Int>()
+            for (mark in a.allMarks()) {
+                if (d1.binarySearch(mark) >= 0) continue
+                if (b.contains(mark)) d2.add(mark)
+            }
+            return create(d1, d2.toIntArray())
+        }
+
+        /**
+         * Sequential composition of two claims that BOTH hold: the caller had already cleaned one
+         * mark when the callee's summary, whose exit abstraction continues the same object,
+         * cleaned another. Marks union; a mark claimed at both depths keeps the stronger (min —
+         * depth 1 covers everything depth 2 does).
+         */
+        fun then(a: AnyFieldMarkExclusions?, b: AnyFieldMarkExclusions?): AnyFieldMarkExclusions? {
+            if (a == null) return b
+            if (b == null) return a
+            if (a == b) return a
+
+            val d1 = (a.marksFromDepth1.toSet() + b.marksFromDepth1.toSet()).toIntArray().also { it.sort() }
+            val d2 = (a.marksFromDepth2.toSet() + b.marksFromDepth2.toSet())
+                .filter { d1.binarySearch(it) < 0 }
+                .toIntArray().also { it.sort() }
+            return create(d1, d2)
+        }
+    }
+}
+
+internal fun AnyFieldMarkExclusions.forExclusions(
+    exclusions: ExclusionSet,
+): AnyFieldMarkExclusions =
+    if (exclusions is ExclusionSet.Universe) AnyFieldMarkExclusions.Empty else this