fix: resolve intermediary variable detection in Java and Python engines

engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java

@@ -691,7 +691,7 @@ public boolean isInvocationOnVariable(
 
             Symbol symbol = symbolOptional.get();
             if (symbol.isVariableSymbol()) {
-                return symbol.name().equals(variable.name());
+                return areSymbolsEquivalent(symbol, variable);
             }
             return true;
         }
@@ -713,13 +713,36 @@ public boolean isInitForVariable(Tree newClass, @Nonnull TraceSymbol<Symbol> var
 
             Symbol symbol = symbolOptional.get();
             if (symbol.isVariableSymbol()) {
-                return symbol.name().equals(variable.name());
+                return areSymbolsEquivalent(symbol, variable);
             }
             return true;
         }
         return false;
     }
 
+    private boolean areSymbolsEquivalent(@Nonnull Symbol s1, @Nonnull Symbol s2) {
+        if (s1.equals(s2)) {
+            return true;
+        }
+
+        Symbol t1 = traceSymbol(s1);
+        Symbol t2 = traceSymbol(s2);
+
+        return t1.equals(t2);
+    }
+
+    @Nonnull
+    private Symbol traceSymbol(@Nonnull Symbol symbol) {
+        Tree declaration = symbol.declaration();
+        if (declaration instanceof VariableTree variableTree) {
+            ExpressionTree initializer = variableTree.initializer();
+            if (initializer instanceof IdentifierTree identifierTree) {
+                return traceSymbol(identifierTree.symbol());
+            }
+        }
+        return symbol;
+    }
+
     @Nonnull
     private Optional<TraceSymbol<Symbol>> getTraceSymbol(
             @Nonnull Parameter<Tree> parameter, @Nonnull Arguments arguments) {

engine/src/main/java/com/ibm/engine/language/python/PythonDetectionEngine.java

@@ -18,7 +18,7 @@
  * limitations under the License.
  */
 package com.ibm.engine.language.python;
-
+ 
 import com.ibm.engine.detection.*;
 import com.ibm.engine.hooks.MethodInvocationHookWithParameterResolvement;
 import com.ibm.engine.hooks.MethodInvocationHookWithReturnResolvement;
@@ -34,6 +34,7 @@
 import org.sonar.plugins.python.api.PythonCheck;
 import org.sonar.plugins.python.api.PythonVisitorContext;
 import org.sonar.plugins.python.api.symbols.Symbol;
+import org.sonar.plugins.python.api.symbols.Usage;
 import org.sonar.plugins.python.api.tree.*;
 
 public class PythonDetectionEngine implements IDetectionEngine<Tree, Symbol> {
@@ -324,8 +325,10 @@ public boolean isInvocationOnVariable(
 
             QualifiedExpression qualifiedExpression = (QualifiedExpression) callee;
             if (qualifiedExpression.qualifier() instanceof Name name) {
-                Optional<String> nameString = Optional.of(name).map(Name::symbol).map(Symbol::name);
-                return nameString.isPresent() && nameString.get().equals(variable.name());
+                Symbol symbol = name.symbol();
+                if (symbol != null) {
+                    return areSymbolsEquivalent(symbol, variable);
+                }
             }
 
             return false;
@@ -346,7 +349,40 @@ public boolean isInitForVariable(Tree newClass, TraceSymbol<Symbol> variableSymb
 
         TraceSymbol<Symbol> traceSymbol = symbolOptional.get();
         Symbol symbol = traceSymbol.getSymbol();
-        return symbol.name().equals(variable.name());
+        if (symbol == null) {
+            return false;
+        }
+        return areSymbolsEquivalent(symbol, variable);
+    }
+
+    private boolean areSymbolsEquivalent(@Nonnull Symbol s1, @Nonnull Symbol s2) {
+        if (s1.equals(s2)) {
+            return true;
+        }
+
+        Symbol t1 = traceSymbol(s1);
+        Symbol t2 = traceSymbol(s2);
+
+        return t1.equals(t2);
+    }
+
+    @Nonnull
+    private Symbol traceSymbol(@Nonnull Symbol symbol) {
+        for (Usage usage : symbol.usages()) {
+            if (usage.kind() == Usage.Kind.ASSIGNMENT_LHS) {
+                Tree parent = usage.tree().parent();
+                if (parent instanceof AssignmentStatement assignment) {
+                    Expression rhs = assignment.assignedValue();
+                    if (rhs instanceof Name name) {
+                        Symbol rhsSymbol = name.symbol();
+                        if (rhsSymbol != null && !rhsSymbol.equals(symbol)) {
+                            return traceSymbol(rhsSymbol);
+                        }
+                    }
+                }
+            }
+        }
+        return symbol;
     }
 
     private void analyseExpression(

java/src/test/files/rules/issues/Issue8IntermediaryVariableTestFile.java

@@ -0,0 +1,18 @@
+package com.ibm.example;
+
+public class Issue8IntermediaryVariableTestFile {
+
+    public class Car {
+        public Car(SeatInterface seat) {}
+    }
+    public interface SeatInterface {}
+    public class LeatherSeats implements SeatInterface {}
+    public class HeatedSeats implements SeatInterface {}
+
+    public void test() {
+        LeatherSeats s = new LeatherSeats();
+        SeatInterface intermediary = s;
+        Car c1 = new Car(s); // Noncompliant {{Car}}
+        Car c2 = new Car(intermediary); // Noncompliant {{Car}}
+    }
+}

java/src/test/java/com/ibm/plugin/rules/issues/Issue8IntermediaryVariableTest.java

@@ -0,0 +1,136 @@
+/*
+ * Sonar Cryptography Plugin
+ * Copyright (C) 2026 PQCA
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.ibm.plugin.rules.issues;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import com.ibm.engine.detection.DetectionStore;
+import com.ibm.engine.model.IValue;
+import com.ibm.engine.model.ValueAction;
+import com.ibm.engine.model.context.IDetectionContext;
+import com.ibm.engine.model.factory.ValueActionFactory;
+import com.ibm.engine.rule.IDetectionRule;
+import com.ibm.engine.rule.builder.DetectionRuleBuilder;
+import com.ibm.mapper.model.INode;
+import com.ibm.plugin.TestBase;
+import java.util.List;
+import javax.annotation.Nonnull;
+import org.junit.jupiter.api.Test;
+import org.sonar.check.Rule;
+import org.sonar.java.checks.verifier.CheckVerifier;
+import org.sonar.plugins.java.api.JavaCheck;
+import org.sonar.plugins.java.api.JavaFileScannerContext;
+import org.sonar.plugins.java.api.semantic.Symbol;
+import org.sonar.plugins.java.api.tree.Tree;
+
+@Rule(key = "Issue8")
+class Issue8IntermediaryVariableTest extends TestBase {
+
+    static IDetectionContext detectionContext =
+            new IDetectionContext() {
+                @Nonnull
+                @Override
+                public Class<? extends IDetectionContext> type() {
+                    return IDetectionContext.class;
+                }
+            };
+
+    public static List<IDetectionRule<Tree>> seatRules =
+            List.of(
+                    new DetectionRuleBuilder<Tree>()
+                            .createDetectionRule()
+                            .forObjectTypes(
+                                    "com.ibm.example.Issue8IntermediaryVariableTestFile$LeatherSeats")
+                            .forConstructor()
+                            .shouldBeDetectedAs(new ValueActionFactory<>("LeatherSeats"))
+                            .withoutParameters()
+                            .buildForContext(detectionContext)
+                            .inBundle(() -> "testBundle")
+                            .withoutDependingDetectionRules(),
+                    new DetectionRuleBuilder<Tree>()
+                            .createDetectionRule()
+                            .forObjectTypes(
+                                    "com.ibm.example.Issue8IntermediaryVariableTestFile$HeatedSeats")
+                            .forConstructor()
+                            .shouldBeDetectedAs(new ValueActionFactory<>("HeatedSeats"))
+                            .withoutParameters()
+                            .buildForContext(detectionContext)
+                            .inBundle(() -> "testBundle")
+                            .withoutDependingDetectionRules());
+
+    public Issue8IntermediaryVariableTest() {
+        super(
+                List.of(
+                        new DetectionRuleBuilder<Tree>()
+                                .createDetectionRule()
+                                .forObjectTypes(
+                                        "com.ibm.example.Issue8IntermediaryVariableTestFile$Car")
+                                .forConstructor()
+                                .shouldBeDetectedAs(new ValueActionFactory<>("Car"))
+                                .withMethodParameter(
+                                        "com.ibm.example.Issue8IntermediaryVariableTestFile$SeatInterface")
+                                .addDependingDetectionRules(seatRules)
+                                .buildForContext(detectionContext)
+                                .inBundle(() -> "testBundle")
+                                .withoutDependingDetectionRules()));
+    }
+
+    @Override
+    public void asserts(
+            int findingId,
+            @Nonnull DetectionStore<JavaCheck, Tree, Symbol, JavaFileScannerContext> detectionStore,
+            @Nonnull List<INode> nodes) {
+        assertThat(detectionStore.getDetectionValues()).hasSize(1);
+        IValue<Tree> value0 = detectionStore.getDetectionValues().get(0);
+        assertThat(value0).isInstanceOf(ValueAction.class);
+        assertThat(value0.asString()).isEqualTo("Car");
+
+        List<DetectionStore<JavaCheck, Tree, Symbol, JavaFileScannerContext>> stores =
+                getStoresOfValueType(ValueAction.class, detectionStore.getChildren());
+
+        assertThat(stores).hasSize(1);
+
+        DetectionStore<JavaCheck, Tree, Symbol, JavaFileScannerContext> store_1 = stores.get(0);
+        assertThat(store_1.getDetectionValues()).hasSize(1);
+        IValue<Tree> value0_1 = store_1.getDetectionValues().get(0);
+        assertThat(value0_1).isInstanceOf(ValueAction.class);
+        assertThat(value0_1.asString()).isEqualTo("LeatherSeats");
+    }
+
+    @Override
+    public void update(
+            @Nonnull com.ibm.engine.detection.Finding<JavaCheck, Tree, Symbol, JavaFileScannerContext> finding) {
+        super.update(finding);
+        finding.detectionStore()
+                .getDetectionValues()
+                .forEach(
+                        iValue -> {
+                            this.reportIssue(iValue.getLocation(), iValue.asString());
+                        });
+    }
+
+    @Test
+    void test() {
+        CheckVerifier.newVerifier()
+                .onFile("src/test/files/rules/issues/Issue8IntermediaryVariableTestFile.java")
+                .withChecks(this)
+                .verifyIssues();
+    }
+}