Problem
Currently, FLAG_ONLY_KINDS only covers eval, computed-key, and unresolved-dynamic. reflection is NOT included, which means:
Reflect.apply(fn, ctx, args) where fn isn't defined in the codebase → silently dropped (no sink edge, no edge at all)
clazz.getMethod("name") where name can't be resolved → silently dropped
::greet where greet doesn't exist in the codebase → silently dropped
This is the same silent-drop problem Phase 0 solved for eval/computed-key.
Proposed fix
Option A: Add reflection to FLAG_ONLY_KINDS — but this would create sink edges for ALL reflection patterns that fail to resolve, including normal .call/.apply on well-typed objects. This might be too broad.
Option B: Add a sub-kind for reflection patterns that ALWAYS need a sink edge (forced-reflection) vs those that should only emit one if they fail to resolve.
Option C: Only add reflection to FLAG_ONLY_KINDS when it comes from explicit API patterns (Reflect.*, getMethod, ::ref) that are always dynamic, not from .call/.apply/.bind which often resolves statically.
Impact
Currently affects: JVM getMethod unresolved cases, Reflect.* patterns where target fn not found.
Severity: Medium — the call is detected but invisible when unresolved.
Problem
Currently,
FLAG_ONLY_KINDSonly coverseval,computed-key, andunresolved-dynamic.reflectionis NOT included, which means:Reflect.apply(fn, ctx, args)wherefnisn't defined in the codebase → silently dropped (no sink edge, no edge at all)clazz.getMethod("name")where name can't be resolved → silently dropped::greetwheregreetdoesn't exist in the codebase → silently droppedThis is the same silent-drop problem Phase 0 solved for eval/computed-key.
Proposed fix
Option A: Add
reflectiontoFLAG_ONLY_KINDS— but this would create sink edges for ALL reflection patterns that fail to resolve, including normal.call/.applyon well-typed objects. This might be too broad.Option B: Add a sub-kind for reflection patterns that ALWAYS need a sink edge (
forced-reflection) vs those that should only emit one if they fail to resolve.Option C: Only add
reflectiontoFLAG_ONLY_KINDSwhen it comes from explicit API patterns (Reflect.*, getMethod, ::ref) that are always dynamic, not from.call/.apply/.bindwhich often resolves statically.Impact
Currently affects: JVM getMethod unresolved cases, Reflect.* patterns where target fn not found.
Severity: Medium — the call is detected but invisible when unresolved.