From cbcc1f71f6dbbfdeef6bbb9495b369395d1389e4 Mon Sep 17 00:00:00 2001
From: Wolfvin <wolfvin@users.noreply.github.com>
Date: Sun, 12 Jul 2026 01:55:56 +0700
Subject: [PATCH] fix(security): taint _detect_languages caused 3x redundant
 scan + duplicate findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

_detect_languages() appended lang to found[] once per matching FILE, not
once per language, because the inner 'break' only exited the marker loop,
not the file loop — and the early-exit guard only ran after an entire
directory's files were exhausted. Any workspace with 3+ matching files in
its first walked directory got that language duplicated N times in the
returned list.

Since the caller iterates 'languages' and re-runs the ENTIRE taint scan
once per entry, this wasn't cosmetic — it caused the whole analysis to run
redundantly 3x (or however many dupes existed), tripling scan time and
(on a codebase with real findings) would have tripled duplicate findings
in the output.

Found via real-codebase validation (Coretax-Auto-Downloader smart-tax-
assistance app): languages_analyzed returned
["typescript","typescript","typescript"], files_analyzed:303 for a
workspace with only 101 actual .ts files. After fix: languages_analyzed
["typescript"], files_analyzed:101 — matches ground truth.
---
 scripts/ast_taint_engine.py | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/scripts/ast_taint_engine.py b/scripts/ast_taint_engine.py
index 3bb578d8..4bd2a101 100644
--- a/scripts/ast_taint_engine.py
+++ b/scripts/ast_taint_engine.py
@@ -3762,17 +3762,31 @@ def _detect_languages(self, workspace: str) -> List[str]:
         }
         found = []
         for lang, markers in lang_markers.items():
+            lang_found = False
             for root, dirs, files in os.walk(workspace):
                 dirs[:] = [d for d in dirs if not d.startswith('.') and d not in DEFAULT_IGNORE_DIRS]
                 for f in files:
                     for marker in markers:
-                        if marker.startswith('.') and f.endswith(marker):
-                            found.append(lang)
+                        if (marker.startswith('.') and f.endswith(marker)) or \
+                           (not marker.startswith('.') and f == marker):
+                            # Bug: found.append(lang) fired once per matching
+                            # FILE (the inner `break` only exits the marker
+                            # loop, not the file loop), and the `if lang in
+                            # found: break` guard only ran after an entire
+                            # directory's files were exhausted — so every
+                            # matching file in the first directory walked got
+                            # appended before the early-exit kicked in. Found
+                            # via real-codebase validation: languages_analyzed
+                            # returned ["typescript","typescript","typescript"]
+                            # for a workspace with 3+ .ts files in its first
+                            # directory. Use a local flag instead so we append
+                            # at most once per language.
+                            lang_found = True
                             break
-                        elif not marker.startswith('.') and f == marker:
-                            found.append(lang)
-                            break
-                if lang in found:
+                    if lang_found:
+                        break
+                if lang_found:
+                    found.append(lang)
                     break
         return found if found else ["python"]