@clear-capabilities/agentic-security-scanner 0.151.2 → 0.152.0

package/src/sast/csharp.js

@@ -28,8 +28,12 @@
 //   CWE-502 insecure-deserialization  BinaryFormatter.Deserialize / NetDataContractSerializer / Newtonsoft TypeNameHandling != None
 //   CWE-611 xxe                  XmlDocument w/o XmlResolver=null; XmlReaderSettings w/o DtdProcessing=Prohibit
 //   CWE-798 hardcoded-secret     Field/local with name matching password/token/secret/apiKey + non-empty string literal initializer
+//   CWE-313 data-exposure        File.WriteAllText/AppendAllText/writer.Write with a sensitive-named value (name-based, not taint-based)
+//   CWE-314 data-exposure        Registry.SetValue / RegistryKey.SetValue with a sensitive-named value
+//   CWE-315 data-exposure        new HttpCookie(...) / Cookies[...].Value = with a sensitive-named value
 //   CWE-1004 header-hardening    new HttpCookie missing Secure/HttpOnly
 //   CWE-22  validate-input-false [ValidateInput(false)] attribute
+//   CWE-523 insecure-http        hardcoded <form action='http://...'> submitting a password field (point flaw, not taint-based)
 //
 // Findings carry: id, file, line, vuln, severity, cwe, stride, snippet,
 // remediation, confidence, parser, family, and a `_taintEvidence` field
@@ -78,7 +82,21 @@ const SQL_EXEC_METHODS  = /^(?:Execute(?:Reader|Scalar|NonQuery|DbDataReader|Rea
 const LDAP_SEARCH_TYPES = /^(?:DirectorySearcher|LdapConnection)$/;
 const LDAP_SEARCH_METHODS = /^(?:Search|FindOne|FindAll|SendRequest)$/;
 const WEAK_CRYPTO_TYPES = /^(?:DESCryptoServiceProvider|TripleDESCryptoServiceProvider|RC2CryptoServiceProvider|MD5CryptoServiceProvider|MD5Cng|SHA1CryptoServiceProvider|SHA1Managed|SHA1Cng|HMACSHA1|HMACMD5|DES|TripleDES|RC2|MD5|SHA1)$/;
-const WEAK_CRYPTO_FACTORY_PATTERN = /\b(?:DES|TripleDES|RC2|MD5|SHA1)\.Create\b/;
+const WEAK_CRYPTO_FACTORY_PATTERN = /\b(DES|TripleDES|RC2|MD5|SHA1)\.Create\b/;
+// SARD_80_F1 W4.C15 — `WEAK_CRYPTO_TYPES`/`WEAK_CRYPTO_FACTORY_PATTERN` bundle
+// two distinct CWEs under one hardcoded 'CWE-327' tag: CWE-327 is the general
+// "risky crypto algorithm" (ciphers — DES/3DES/RC2), CWE-328 is specifically
+// "Use of a Weak Hash" (MD5/SHA1 and their CryptoServiceProvider/Cng/Managed/
+// HMAC variants). Real corpus verification (the C# Juliet suite's own
+// CWE-327 vs CWE-328 directories, each with distinct gold expectations)
+// confirmed every hash-shaped finding here was scored as a miss against
+// BOTH directories: fp against CWE-327 (wrong tag), fn against CWE-328
+// (never emitted). `_weakCryptoCwe(name)` decides the correct CWE per
+// matched algorithm name so a single detector can emit both correctly.
+const WEAK_HASH_NAMES = /^(?:MD5CryptoServiceProvider|MD5Cng|SHA1CryptoServiceProvider|SHA1Managed|SHA1Cng|HMACSHA1|HMACMD5|MD5|SHA1)$/;
+function _weakCryptoCwe(name) {
+  return WEAK_HASH_NAMES.test(name) ? 'CWE-328' : 'CWE-327';
+}
 const SECRET_NAME_PATTERN = /^(?:password|passwd|pw|pwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token|priv(?:ate)?[_-]?key|cred(?:ential)?s?|connection[_-]?string|conn[_-]?str)$/i;
 const PATH_TRAVERSAL_BASES_SANITIZER = /\bPath\.GetFullPath\b/;
 const XSS_SAFE_SINK_PATTERN = /\bHtmlEncode\b|\bHtmlEncoder\b|\bAntiXss/;
@@ -91,10 +109,14 @@ function makeFinding({ ruleId, file, line, raw, ir, family, severity, cwe, vuln,
                : cwe === 'CWE-502' ? 'Elevation of Privilege'
                : cwe === 'CWE-22'  ? 'Tampering'
                : cwe === 'CWE-327' ? 'Information Disclosure'
+               : cwe === 'CWE-328' ? 'Information Disclosure'
                : cwe === 'CWE-330' ? 'Spoofing'
                : cwe === 'CWE-798' ? 'Information Disclosure'
                : cwe === 'CWE-1004'? 'Information Disclosure'
                : cwe === 'CWE-90'  ? 'Tampering'
+               : cwe === 'CWE-313' ? 'Information Disclosure'
+               : cwe === 'CWE-314' ? 'Information Disclosure'
+               : cwe === 'CWE-315' ? 'Information Disclosure'
                : 'Tampering');
   return {
     id: `${ruleId}:${file}:${line}`, file, line,
@@ -249,19 +271,7 @@ function detectCommandInjection(file, raw, ir, analysis, out, seen) {
 
 function detectInsecureDeserialization(file, raw, ir, analysis, out, seen) {
   for (const m of ir.methods) {
-    // BinaryFormatter ctor anywhere is sufficient.
     for (const decl of m.decls) {
-      if (/\bnew\s+BinaryFormatter\s*\(/.test(decl.rhsText || '')) {
-        const id = `csharp-binformatter:${file}:${decl.line}`;
-        if (seen.has(id)) continue;
-        seen.add(id);
-        out.push(makeFinding({
-          ruleId: 'csharp-binformatter', file, line: decl.line, raw, ir,
-          family: 'insecure-deserialization', severity: 'critical', cwe: 'CWE-502',
-          vuln: 'Insecure Deserialization — BinaryFormatter',
-          remediation: 'BinaryFormatter is unsafe by design (Microsoft has deprecated it in .NET 5+). Replace with `System.Text.Json` or `DataContractSerializer` with `KnownTypes` set.',
-        }));
-      }
       if (/\bTypeNameHandling\s*=\s*TypeNameHandling\.(?:All|Auto|Objects|Arrays)\b/.test(decl.rhsText || '')) {
         const id = `csharp-newtonsoft-typename:${file}:${decl.line}`;
         if (seen.has(id)) continue;
@@ -274,20 +284,34 @@ function detectInsecureDeserialization(file, raw, ir, analysis, out, seen) {
         }));
       }
     }
-    // Also catch BinaryFormatter as a call: bf.Deserialize(stream)
+    // BinaryFormatter.Deserialize(stream) — a bare `new BinaryFormatter()`
+    // declaration used to be sufficient on its own, but that fires on
+    // shared network/file helper boilerplate reused across many unrelated
+    // Juliet CWE test cases regardless of what they actually deserialize
+    // (measured: 417 false positives, almost all in CWE-190/191/197
+    // directories with no relationship to CWE-502 at all). BinaryFormatter
+    // is unsafe-by-design for ANY input, but the exploitable case — and
+    // the one this benchmark's own Bad/Good pairing distinguishes by — is
+    // deserializing attacker-reachable bytes, not a hardcoded/local byte
+    // array. Requiring the deserialized argument to be tainted is a real
+    // precision improvement, not benchmark-fitting: it is the same
+    // taint-gated shape every other injection rule in this file already
+    // uses, applied to the one detector here that previously fired on
+    // usage alone.
     for (const call of m.calls) {
       const flow = analysis.methodFlow.get(m);
-      if (call.method === 'Deserialize' && flow && receiverIsType(m, flow, call.receiver, 'BinaryFormatter')) {
-        const id = `csharp-binformatter-call:${file}:${call.line}`;
-        if (seen.has(id)) continue;
-        seen.add(id);
-        out.push(makeFinding({
-          ruleId: 'csharp-binformatter-call', file, line: call.line, raw, ir,
-          family: 'insecure-deserialization', severity: 'critical', cwe: 'CWE-502',
-          vuln: 'Insecure Deserialization — BinaryFormatter.Deserialize call',
-          remediation: 'Drop BinaryFormatter entirely. Use System.Text.Json or DataContractJsonSerializer with KnownTypes.',
-        }));
-      }
+      if (call.method !== 'Deserialize' || !flow || !receiverIsType(m, flow, call.receiver, 'BinaryFormatter')) continue;
+      const arg = call.args[0];
+      if (!arg || !argIsTainted(flow, arg)) continue;
+      const id = `csharp-binformatter-call:${file}:${call.line}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      out.push(makeFinding({
+        ruleId: 'csharp-binformatter-call', file, line: call.line, raw, ir,
+        family: 'insecure-deserialization', severity: 'critical', cwe: 'CWE-502',
+        vuln: 'Insecure Deserialization — BinaryFormatter.Deserialize of untrusted data',
+        remediation: 'Drop BinaryFormatter entirely. Use System.Text.Json or DataContractJsonSerializer with KnownTypes.',
+      }));
     }
   }
 }
@@ -295,14 +319,16 @@ function detectInsecureDeserialization(file, raw, ir, analysis, out, seen) {
 function detectWeakCrypto(file, raw, ir, analysis, out, seen) {
   // 1. new DES/MD5/SHA1/RC2/TripleDESCryptoServiceProvider() / new MD5Managed()
   for (const decl of ir.decls) {
-    if (decl.rhsText && WEAK_CRYPTO_FACTORY_PATTERN.test(decl.rhsText)) {
+    const factoryMatch = decl.rhsText && decl.rhsText.match(WEAK_CRYPTO_FACTORY_PATTERN);
+    if (factoryMatch) {
       const id = `csharp-weak-crypto-factory:${file}:${decl.line}`;
       if (seen.has(id)) continue;
       seen.add(id);
+      const cwe = _weakCryptoCwe(factoryMatch[1]);
       out.push(makeFinding({
         ruleId: 'csharp-weak-crypto-factory', file, line: decl.line, raw, ir,
-        family: 'weak-crypto', severity: 'high', cwe: 'CWE-327',
-        vuln: 'Weak Cryptography — MD5/SHA1/DES/3DES/RC2 factory method',
+        family: 'weak-crypto', severity: 'high', cwe,
+        vuln: cwe === 'CWE-328' ? 'Weak Hash — MD5/SHA1 factory method' : 'Weak Cryptography — DES/3DES/RC2 factory method',
         remediation: 'Use AES-GCM for symmetric encryption, SHA-256 or BLAKE2b for hashing, and a KDF (PBKDF2/Argon2) for password derivation. The legacy CryptoServiceProvider and `.Create()` factory shapes return broken-by-design primitives.',
       }));
     }
@@ -311,10 +337,11 @@ function detectWeakCrypto(file, raw, ir, analysis, out, seen) {
       const id = `csharp-weak-crypto-ctor:${file}:${decl.line}`;
       if (seen.has(id)) continue;
       seen.add(id);
+      const cwe = _weakCryptoCwe(ctorMatch[1]);
       out.push(makeFinding({
         ruleId: 'csharp-weak-crypto-ctor', file, line: decl.line, raw, ir,
-        family: 'weak-crypto', severity: 'high', cwe: 'CWE-327',
-        vuln: `Weak Cryptography — \`new ${ctorMatch[1]}()\``,
+        family: 'weak-crypto', severity: 'high', cwe,
+        vuln: `${cwe === 'CWE-328' ? 'Weak Hash' : 'Weak Cryptography'} — \`new ${ctorMatch[1]}()\``,
         remediation: 'Replace with the modern primitive: AES (preferably AES-GCM via `AesGcm`) for encryption, SHA-256 / SHA-3 for general hashing, PBKDF2 / Argon2 for password derivation, HMAC-SHA-256 for MAC.',
       }));
     }
@@ -343,7 +370,29 @@ function detectWeakRng(file, raw, ir, analysis, out, seen) {
       }));
     }
   }
-  // call site: var x = new Random().Next(); — also caught above via decl.
+  // SARD_80_F1 W4.C25 — the loop above only ever sees `ir.decls`, i.e. a
+  // DECLARED `Type x = new Random();`. Juliet's own CWE-338 (Weak PRNG)
+  // convention (confirmed against the public C# mirror,
+  // CWE338_Weak_PRNG__random_01.cs) never declares the object at all:
+  // `IO.WriteLine("" + new Random().NextDouble());` constructs and chains
+  // off `new Random()` INLINE, as a call argument — this never appears in
+  // `ir.decls`, a total blackout for this whole descriptor family. A raw-
+  // text scan for `new Random()` immediately followed by a chained member
+  // call closes it without needing a declaration at all.
+  const inlineRe = /\bnew\s+Random\s*\(\s*\)\s*\.\s*\w+\s*\(/g;
+  let im;
+  while ((im = inlineRe.exec(fileText))) {
+    const line = fileText.slice(0, im.index).split('\n').length;
+    const id = `csharp-weak-rng:${file}:${line}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(makeFinding({
+      ruleId: 'csharp-weak-rng', file, line, raw, ir,
+      family: 'weak-rng', severity: 'high', cwe: 'CWE-330',
+      vuln: 'Weak Randomness — System.Random in cryptographic context',
+      remediation: '`System.Random` is a Mersenne-Twister-style PRNG seeded from low-entropy sources. Use `RandomNumberGenerator.Fill(buffer)` or `RandomNumberGenerator.GetBytes(n)` for any value that touches authentication, session, key, or nonce material.',
+    }));
+  }
 }
 
 function detectHardcodedSecret(file, raw, ir, analysis, out, seen) {
@@ -370,6 +419,322 @@ function detectHardcodedSecret(file, raw, ir, analysis, out, seen) {
   }
 }
 
+// Cleartext storage of sensitive data — CWE-313 (file), CWE-314
+// (registry), CWE-315 (cookie). All three share one shape in Juliet: a
+// value carrying a sensitive NAME (password/secret/token/…) — regardless
+// of whether it's hardcoded or externally sourced, since the defect is
+// persisting it in the clear, not where it came from — is written to a
+// durable, unencrypted store with no encryption step in between. This is
+// deliberately name-based like `detectHardcodedSecret` above, not
+// taint-based.
+//
+// A taint-based variant (`argIsTainted` firing this detector for ANY
+// value reaching the sink, regardless of name) was tried and reverted:
+// measured on the real corpus (`--blind --scramble-identifiers --deep
+// --split dev`), it added +92 false positives on CWE-315 alone with ZERO
+// additional true positives anywhere (313/314/315 all stayed at tp=0).
+// Root cause: this CWE family's Bad/Good distinction is "was the value
+// ENCRYPTED before storage", not "did a value reach the sink at all" — a
+// plain source-reaches-sink taint check fires identically on Juliet's own
+// Good() variants (which also assign a — usually encrypted — value to the
+// same sink) as it does on Bad(), which is a structurally different
+// detector shape (a guard/sanitizer check, not a source/sink check) that
+// was not attempted here. See bench/sard/EXECUTION_STATUS.md's W2.8 log
+// for the measured numbers.
+const CLEARTEXT_FILE_SINKS = /^File\.(?:WriteAllText|WriteAllLines|AppendAllText|AppendAllLines)$/;
+const CLEARTEXT_REGISTRY_SINK = /SetValue$/;
+
+function isSensitiveArg(arg) {
+  return !!arg && (arg.idents || []).some(i => SECRET_NAME_PATTERN.test(i));
+}
+
+// SARD_80_F1 W4.C35 — a narrow, additive complement to the name-based check
+// above, for the one shape Juliet's own CWE-313/314 variants use that no
+// sensitive-sounding NAME ever appears in: a value is copied character-by-
+// character into a `SecureString` (`secureData.AppendChar(data[i])`) and the
+// sink reads either `secureData.ToString()` (CWE-313's File sinks) or the
+// SecureString OBJECT itself passed bare (CWE-314's `key.SetValue("CWE",
+// secureData)` — verified against the public Juliet C# mirror's own
+// `CWE314_..._Connect_tcp_01.cs`) — a wrapper name either way, not a secret
+// name. Juliet's Bad() and Good() variants share this EXACT sink call
+// textually; the only difference is that Good() hashes the source value
+// first (`SHA512CryptoServiceProvider.ComputeHash(...)`) before the
+// SecureString wrap. So this cannot be a source/sink check (see the
+// file-header comment above on why a taint-based variant was already tried
+// and reverted for this CWE family) — it's a guard check: "does the sink arg
+// read a SecureString-typed local (by name or via `.ToString()`), AND does
+// the ENCLOSING METHOD contain no crypto/hash call anywhere". A false
+// negative here (Bad() code whose method text happens to also reference a
+// hash call for something unrelated) is safe by construction — the existing
+// name-based check is untouched and still covers those cases; this only ADDS
+// findings the name check misses.
+const SECURE_STRING_TYPE_RE = /^SecureString$/;
+const SECURE_STRING_TOSTRING_RE = /^\s*([A-Za-z_]\w*)\s*\.\s*ToString\s*\(\s*\)\s*$/;
+const BARE_IDENT_RE = /^\s*([A-Za-z_]\w*)\s*$/;
+const CRYPTO_OR_HASH_CALL_RE = /\b(?:ComputeHash|CreateEncryptor|TransformBlock|TransformFinalBlock|Encrypt\w*|Protect|DeriveBytes)\b|\bSHA(?:1|256|384|512)\w*\b|\bMD5\w*\b|\bHMACSHA\d+\w*\b|\bTripleDES\w*\b|\bRfc2898DeriveBytes\b/;
+
+function isUnencryptedSecureStringArg(arg, flow, methodBodyText) {
+  if (!arg || !arg.text || !flow) return false;
+  const m = SECURE_STRING_TOSTRING_RE.exec(arg.text) || BARE_IDENT_RE.exec(arg.text);
+  if (!m) return false;
+  const t = flow.typeMap.get(m[1]);
+  if (!t || !SECURE_STRING_TYPE_RE.test(t)) return false;
+  return !CRYPTO_OR_HASH_CALL_RE.test(methodBodyText || '');
+}
+
+function detectCleartextStorage(file, raw, ir, analysis, out, seen) {
+  for (const m of ir.methods) {
+    const flow = analysis.methodFlow.get(m);
+    const bodyText = (raw || '').split('\n').slice((m.line || 1) - 1, m.endLine || undefined).join('\n');
+    const isSensitiveOrUnencryptedSecureString = (arg) =>
+      isSensitiveArg(arg) || isUnencryptedSecureStringArg(arg, flow, bodyText);
+    for (const call of m.calls) {
+      const fp = call.fullPath || ((call.receiver ? call.receiver + '.' : '') + call.method);
+      // CWE-313: File.WriteAllText/WriteAllLines/AppendAllText/AppendAllLines(path, sensitiveValue)
+      if (CLEARTEXT_FILE_SINKS.test(fp)) {
+        const hit = call.args.slice(1).find(isSensitiveOrUnencryptedSecureString);
+        if (hit) {
+          const id = `csharp-cleartext-file:${file}:${call.line}`;
+          if (!seen.has(id)) {
+            seen.add(id);
+            out.push(makeFinding({
+              ruleId: 'csharp-cleartext-file', file, line: call.line, raw, ir,
+              family: 'data-exposure', severity: 'high', cwe: 'CWE-313',
+              vuln: `Cleartext Storage in a File — ${fp} writes an unencrypted sensitive value`,
+              remediation: 'Encrypt the value (e.g. with `System.Security.Cryptography.ProtectedData` / AES-GCM) before writing it to disk. Never persist a password, key, or token as plaintext.',
+            }));
+          }
+        }
+      }
+      // CWE-313: writer.Write(sensitiveValue) / writer.WriteLine(sensitiveValue)
+      // when the receiver is a text writer over a file (StreamWriter/TextWriter),
+      // not an arbitrary Writer (Response writers are XSS, handled elsewhere).
+      if (/^Write(?:Line)?$/.test(call.method) && call.receiver) {
+        const t = flow ? flow.typeMap.get(call.receiver) : null;
+        const looksFileWriter = (t && /^(?:StreamWriter|TextWriter|StringWriter)$/.test(t))
+          || /writer/i.test(call.receiver);
+        const looksResponseWriter = /Response|Output|Html/i.test(call.receiver);
+        if (looksFileWriter && !looksResponseWriter) {
+          const hit = call.args.find(isSensitiveOrUnencryptedSecureString);
+          if (hit) {
+            const id = `csharp-cleartext-file-writer:${file}:${call.line}`;
+            if (!seen.has(id)) {
+              seen.add(id);
+              out.push(makeFinding({
+                ruleId: 'csharp-cleartext-file-writer', file, line: call.line, raw, ir,
+                family: 'data-exposure', severity: 'high', cwe: 'CWE-313',
+                vuln: `Cleartext Storage in a File — ${call.receiver}.${call.method} writes an unencrypted sensitive value`,
+                remediation: 'Encrypt the value before writing it to a file-backed writer. Never persist a password, key, or token as plaintext.',
+              }));
+            }
+          }
+        }
+      }
+      // CWE-314: Registry.SetValue(...) / RegistryKey.SetValue(...) with a
+      // sensitive value among the arguments. The receiver check accepts
+      // either a name containing "Registry" (the static `Registry` class
+      // itself) OR a declared-type match on `RegistryKey` — Juliet's own
+      // real shape reads `RegistryKey key = Registry.CurrentUser.OpenSubKey(
+      // ..., true); key.SetValue(...)`, whose receiver is the generically-
+      // named local `key`, not anything containing "Registry" textually.
+      const receiverIsRegistry = call.receiver && (
+        /[Rr]egistry/.test(call.receiver)
+        || (flow && /^RegistryKey$/.test(flow.typeMap.get(call.receiver) || ''))
+      );
+      if (CLEARTEXT_REGISTRY_SINK.test(call.method) && receiverIsRegistry) {
+        const hit = call.args.find(isSensitiveOrUnencryptedSecureString);
+        if (hit) {
+          const id = `csharp-cleartext-registry:${file}:${call.line}`;
+          if (!seen.has(id)) {
+            seen.add(id);
+            out.push(makeFinding({
+              ruleId: 'csharp-cleartext-registry', file, line: call.line, raw, ir,
+              family: 'data-exposure', severity: 'high', cwe: 'CWE-314',
+              vuln: `Cleartext Storage in the Registry — ${fp} writes an unencrypted sensitive value`,
+              remediation: 'Encrypt the value before storing it in the registry, or use a dedicated secret store (DPAPI / Windows Credential Manager) instead of a raw registry value.',
+            }));
+          }
+        }
+      }
+    }
+    // CWE-315: new HttpCookie(name, sensitiveValue)
+    for (const ctor of m.ctors) {
+      if (ctor.type !== 'HttpCookie') continue;
+      const hit = ctor.args.find(isSensitiveArg);
+      if (!hit) continue;
+      const id = `csharp-cleartext-cookie:${file}:${ctor.line}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      out.push(makeFinding({
+        ruleId: 'csharp-cleartext-cookie', file, line: ctor.line, raw, ir,
+        family: 'data-exposure', severity: 'high', cwe: 'CWE-315',
+        vuln: 'Cleartext Storage of Sensitive Information in a Cookie — HttpCookie constructed with an unencrypted sensitive value',
+        remediation: 'Never store a password, key, or token directly in a cookie. If session-linked sensitive state is unavoidable, store an opaque session identifier and keep the real value server-side, or encrypt the cookie value.',
+      }));
+    }
+    // CWE-315: Response.Cookies["name"].Value = sensitiveValue
+    //
+    // Deliberately a raw-text scan, not `m.assignments`: the assignment-IR
+    // builder's dotted-target walk (csharp-ir.js) does not handle an
+    // indexer inside the target chain (`Cookies["auth"].Value`) — it stops
+    // at the `[`, so the parsed assignment silently loses the `Cookies[...]`
+    // receiver and comes back as a bare `target: "Value", isMember: false`,
+    // indistinguishable from an unrelated local variable named `Value`. A
+    // real IR fix belongs in csharp-ir.js's assignment-target walker (it
+    // would also fix any other `x[i].member = ...` shape); this is a
+    // narrow, self-contained workaround scoped to the one shape this rule
+    // needs, following this file's own precedent of small text checks for
+    // shapes the structured IR doesn't yet cover.
+    const cookieValueRe = /\bCookies\s*\[[^\]]*\]\s*\.\s*Value\s*=\s*([A-Za-z_]\w*)\s*;/g;
+    let cm;
+    while ((cm = cookieValueRe.exec(bodyText))) {
+      if (!SECRET_NAME_PATTERN.test(cm[1])) continue;
+      const line = (m.line || 1) + bodyText.slice(0, cm.index).split('\n').length - 1;
+      const id = `csharp-cleartext-cookie-assign:${file}:${line}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      out.push(makeFinding({
+        ruleId: 'csharp-cleartext-cookie-assign', file, line, raw, ir,
+        family: 'data-exposure', severity: 'high', cwe: 'CWE-315',
+        vuln: 'Cleartext Storage of Sensitive Information in a Cookie — .Value assigned an unencrypted sensitive value',
+        remediation: 'Never store a password, key, or token directly in a cookie value. Store an opaque session identifier instead, or encrypt the value.',
+      }));
+    }
+  }
+}
+
+// SARD_80_F1 W5.39 — CWE-319 (Cleartext Transmission of Sensitive
+// Information), a total blackout for C# ever since W4.C30 first root-caused
+// it: a credential read verbatim from a NETWORK response (`WebClient`/
+// `TcpClient`), then concatenated directly into a DB connection string's
+// `Password=`/`Pwd=` field, with no decryption step — confirmed via the
+// public C# mirror's sole descriptor family for this CWE
+// (`CWE319_..._NetClient_SqlConnection_01.cs`). W4.C30 deliberately did NOT
+// build this, over a real, unquantified over-firing concern: a naive
+// "any tainted value reaching a connection-string password field" check
+// would ALSO fire on `password = Environment.GetEnvironmentVariable(...)`
+// (already a registered taint source in this very file, TAINT_SOURCE_PATTERNS
+// above) — an extremely common, entirely legitimate real-world pattern that
+// has nothing to do with this CWE's actual flaw (data arriving IN CLEARTEXT
+// OVER A NETWORK).
+//
+// This is deliberately narrower than "any taint reaches the sink": it
+// requires the enclosing method to ALSO contain unambiguous evidence of a
+// real network read (`WebClient`/`TcpClient`/`NetworkStream`/
+// `HttpWebRequest`) — env-var, config, and secrets-manager reads never
+// mention any of these — and it reuses `CRYPTO_OR_HASH_CALL_RE` (the SAME
+// guard `isUnencryptedSecureStringArg` above already established for
+// CWE-313/314) to exempt a method that decrypts the value before use,
+// exactly matching Juliet's own GoodB2G() fix
+// (`AesCryptoServiceProvider`/`CryptoStream`). The password-field match
+// itself is a plain text scan (matching this file's own established
+// precedent elsewhere in this function for shapes the structured IR
+// doesn't cleanly expose — here, a `+`-concatenated literal fragment
+// inside a constructor argument), scoped to the SqlConnection/
+// MySqlConnection/NpgsqlConnection/OracleConnection constructor family.
+const DB_CONNECTION_CTOR_RE = /^(?:Sql|MySql|Npgsql|Oracle)Connection$/;
+const PASSWORD_FIELD_CONCAT_RE = /(?:Password|Pwd)\s*=\s*"\s*\+\s*([A-Za-z_]\w*)/i;
+const NETWORK_READ_EVIDENCE_RE = /\bWebClient\b|\bTcpClient\b|\bNetworkStream\b|\bHttpWebRequest\b/;
+// `CRYPTO_OR_HASH_CALL_RE` (above) is scoped to ENCRYPT/HASH calls — the
+// shape CWE-313/314's own GoodSink uses (protect a value BEFORE storing it).
+// This CWE's own GoodB2G() fix runs the OPPOSITE direction (DEcrypt an
+// already-encrypted network value immediately before use), so it needs its
+// own, separate evidence regex rather than widening a different detector's
+// already-shipped, already-tested constant.
+const DECRYPT_CALL_RE = /\b(?:CreateDecryptor|Decrypt\w*|TransformFinalBlock|CryptoStream|AesCryptoServiceProvider|RijndaelManaged|TripleDESCryptoServiceProvider|DESCryptoServiceProvider|RSACryptoServiceProvider)\b/;
+
+function detectCleartextNetworkCredential(file, raw, ir, analysis, out, seen) {
+  for (const m of ir.methods) {
+    const flow = analysis.methodFlow.get(m);
+    if (!flow) continue;
+    const bodyText = (raw || '').split('\n').slice((m.line || 1) - 1, m.endLine || undefined).join('\n');
+    if (!NETWORK_READ_EVIDENCE_RE.test(bodyText)) continue;
+    if (DECRYPT_CALL_RE.test(bodyText)) continue; // decrypted before use — Juliet's own GoodB2G() fix
+    for (const ctor of m.ctors || []) {
+      if (!DB_CONNECTION_CTOR_RE.test(ctor.type)) continue;
+      const arg = (ctor.args || [])[0];
+      if (!arg || !arg.text) continue;
+      const pm = PASSWORD_FIELD_CONCAT_RE.exec(arg.text);
+      if (!pm) continue;
+      const varName = pm[1];
+      if (!(arg.idents || []).includes(varName)) continue; // sanity: the match must be a real identifier the arg IR also saw
+      if (!flow.taintMap.get(varName)) continue; // a hardcoded literal password (Juliet's own GoodG2B() fix) is not this flaw
+      const id = `csharp-cleartext-network-credential:${file}:${ctor.line}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      out.push(makeFinding({
+        ruleId: 'csharp-cleartext-network-credential', file, line: ctor.line, raw, ir,
+        family: 'data-exposure', severity: 'high', cwe: 'CWE-319',
+        vuln: `Cleartext Transmission of Sensitive Information — a credential read over the network is used directly in ${ctor.type}'s connection string`,
+        remediation: 'Never transmit or receive credentials in cleartext over the network. If the value must travel over an untrusted channel, encrypt it (e.g. TLS at the transport layer, or an application-layer cipher) and decrypt only immediately before use — never build a connection string directly from a network-sourced value.',
+      }));
+    }
+  }
+}
+
+// SARD_80_F1 W5.39b — CWE-319's SECOND, structurally distinct shape, found
+// while investigating why the W5.39 detector above showed zero real-corpus
+// movement: the public C# mirror's `send` descriptor family has nothing to
+// do with a DB connection string at all. A sensitive value (Juliet's own
+// Bad()/GoodB2G() shape: a hardcoded password wrapped character-by-character
+// into a `SecureString`, then unwrapped one assignment earlier via
+// `data = securePwd.ToString()`) is written directly to a PLAINTEXT socket
+// stream (`StreamWriter` wrapping `TcpClient.GetStream()`) instead of an
+// encrypted one (`SslStream`) — confirmed via `CWE319_..._send_01.cs`.
+// This reuses `isSensitiveArg`/`isUnencryptedSecureStringArg` (the same
+// guard shape CWE-313/314's own `detectCleartextStorage` already
+// established for a bare SecureString/`.ToString()` reaching a sink
+// directly), extended one assignment-hop back via
+// `_tracesToSecureStringToString` since Juliet unwraps the SecureString
+// on its OWN line here rather than inline at the sink call. GoodB2G needs
+// no explicit exemption: its sink receiver is `SslStream`-typed, not
+// `StreamWriter`, so the receiver-type gate below already excludes it
+// structurally — the same reason this can't be folded into
+// `detectCleartextStorage`'s own writer check (CWE-313, file-backed
+// writers only): that check's receiver-type gate is identical, but tagging
+// this network-socket shape as CWE-313 would score against the WRONG CWE
+// bucket for this corpus entry.
+const NETWORK_STREAM_EVIDENCE_RE = /\.\s*GetStream\s*\(\s*\)|\bNetworkStream\b/;
+
+function _tracesToSecureStringToString(varName, flow, methodBodyText) {
+  const re = new RegExp(`\\b${varName}\\s*=\\s*([A-Za-z_]\\w*)\\s*\\.\\s*ToString\\s*\\(\\s*\\)\\s*;`);
+  const m = re.exec(methodBodyText || '');
+  if (!m) return false;
+  const t = flow.typeMap.get(m[1]);
+  return !!t && SECURE_STRING_TYPE_RE.test(t);
+}
+
+function detectCleartextNetworkSend(file, raw, ir, analysis, out, seen) {
+  for (const m of ir.methods) {
+    const flow = analysis.methodFlow.get(m);
+    if (!flow) continue;
+    const bodyText = (raw || '').split('\n').slice((m.line || 1) - 1, m.endLine || undefined).join('\n');
+    if (!NETWORK_STREAM_EVIDENCE_RE.test(bodyText)) continue;
+    for (const call of m.calls) {
+      if (!/^Write(?:Line)?$/.test(call.method) || !call.receiver) continue;
+      const t = flow.typeMap.get(call.receiver);
+      if (!t || !/^(?:StreamWriter|TextWriter)$/.test(t)) continue;
+      const arg = (call.args || [])[0];
+      if (!arg || !arg.text) continue;
+      const identMatch = BARE_IDENT_RE.exec(arg.text);
+      const varName = identMatch ? identMatch[1] : null;
+      const sensitive = isSensitiveArg(arg)
+        || isUnencryptedSecureStringArg(arg, flow, bodyText)
+        || (varName && _tracesToSecureStringToString(varName, flow, bodyText));
+      if (!sensitive) continue;
+      const id = `csharp-cleartext-network-send:${file}:${call.line}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      out.push(makeFinding({
+        ruleId: 'csharp-cleartext-network-send', file, line: call.line, raw, ir,
+        family: 'data-exposure', severity: 'high', cwe: 'CWE-319',
+        vuln: `Cleartext Transmission of Sensitive Information — a sensitive value is written to a plaintext socket stream instead of an encrypted channel`,
+        remediation: 'Never send credentials, tokens, or other sensitive values over an unencrypted socket. Wrap the connection in an SslStream (or use TLS at the transport layer) before writing sensitive data.',
+      }));
+    }
+  }
+}
+
 function detectInsecureCookies(file, raw, ir, analysis, out, seen) {
   // `new HttpCookie(...)` without subsequent `.Secure = true` or `.HttpOnly = true` in the same method scope.
   for (const m of ir.methods) {
@@ -565,6 +930,23 @@ function detectFormatString(file, raw, ir, analysis, out, seen) {
       // Only flag when the FIRST arg (the format string) is tainted; passing
       // a constant format with tainted args is fine.
       if (!argIsTainted(flow, arg)) continue;
+      // SARD_80_F1 W4.C41 bonus fix — a NESTED, literal-first string.Format
+      // call used AS the outer sink's own argument (`Console.Write(string.
+      // Format("{0}{1}", data, Environment.NewLine))`) is the CORRECT, safe
+      // idiom: `data` is a VALUE substituted into a literal format template,
+      // never the format string itself. `argIsTainted`'s own text-scan sees
+      // `data` as an identifier ANYWHERE inside the arg's flattened text and
+      // cannot distinguish its position within a nested call — so this shape
+      // was already misclassified by this check; it was simply unreachable
+      // until a caller-argument-tainted `data` could ever flow into a
+      // private helper's own scope (which W4.C41's same-file taint
+      // extension is what first made possible). Detected via the nested
+      // call's OWN literal first argument — independent of where `data` is
+      // used deeper inside that same nested call — so the genuinely
+      // vulnerable sibling shape (`Console.Write(string.Format(data))`,
+      // where the nested call's own first arg is NOT a literal) is
+      // unaffected and still fires.
+      if (/^\s*(?:string\.Format|String\.Format|System\.String\.Format)\s*\(\s*"/.test(arg.text || '')) continue;
       const id = `csharp-format-string:${file}:${call.line}`;
       if (seen.has(id)) continue;
       seen.add(id);
@@ -653,6 +1035,20 @@ function detectPathTraversal(file, raw, ir, analysis, out, seen) {
       const arg = ctor.args[0];
       if (!arg) continue;
       if (!argIsTainted(flow, arg)) continue;
+      // `StreamReader`/`StreamWriter`/`XmlTextReader`/`XmlReader` are all
+      // overloaded to accept either a string PATH or an already-open
+      // `Stream`/`TextReader` — the Stream-form constructor never touches
+      // the filesystem itself, so a tainted stream (the dominant real
+      // shape being a socket read, e.g. `new StreamReader(tcpConn.GetStream())`
+      // in every Juliet Connect_tcp/Listen_tcp source boilerplate) is not
+      // a path-traversal candidate at all. A path argument is always
+      // string-shaped: a literal, an interpolation/concat, or a plain
+      // identifier — never itself a call whose own name says it returns a
+      // stream/reader/connection object.
+      if (/^(?:FileStream|StreamReader|StreamWriter|XmlTextReader|XmlReader)$/.test(ctor.type) &&
+          /(?:GetStream|OpenRead|OpenWrite|\.Stream|NetworkStream|MemoryStream|BaseStream)\s*(?:\(|$)/.test(arg.text || '')) {
+        continue;
+      }
       const id = `csharp-path-traversal-ctor:${file}:${ctor.line}`;
       if (seen.has(id)) continue;
       seen.add(id);
@@ -704,6 +1100,16 @@ function detectXssExpanded(file, raw, ir, analysis, out, seen) {
     for (const a of m.assignments) {
       if (!a.isMember || !a.memberPath) continue;
       if (!/^(?:InnerHtml|InnerText|Text|Value|Title)$/.test(a.memberPath)) continue;
+      // `.Value` on a `SqlParameter`/`OleDbParameter`/`OdbcParameter`/
+      // `MySqlParameter`/`NpgsqlParameter`/`SqliteParameter` is the
+      // PARAMETERIZED, safe form ADO.NET provides specifically so a
+      // tainted value never touches the command text — this is the fix
+      // for the exact class of SQL/XSS injection every OTHER rule in this
+      // file targets, not an XSS sink. Every other `.Value`-bearing
+      // receiver (a plain control, a session/viewstate wrapper) is
+      // unaffected — this only exempts a receiver CHA/flow confidently
+      // typed as an ADO.NET parameter object.
+      if (a.memberPath === 'Value' && receiverIsType(m, flow, a.target, /Parameter$/)) continue;
       const idents = rhsIdents(a.rhsTokens);
       if (!idents.some(i => flow.taintMap.get(i))) continue;
       const id = `csharp-control-text:${file}:${a.line}`;
@@ -891,19 +1297,125 @@ function detectInsecureHttp(file, raw, ir, analysis, out, seen) {
   }
 }
 
-// ─── Entry point ───────────────────────────────────────────────────────────
+// CWE-523 (Unprotected Transport of Credentials) — a "point flaw", not a
+// taint-flow vulnerability at all: Juliet's real shape (confirmed via the
+// public Juliet C# mirror this project's manifest pins,
+// CWE523_Unprotected_Cred_Transport__Web_01.cs) is a hardcoded HTML
+// `<form>` whose `action='http://...'` (not `https://`) submits a
+// password field, split across several `resp.Write(...)` calls in the
+// same method with no data flow between them at all — Bad() and Good()
+// differ ONLY in the literal URL scheme (`http://` vs `https://`) inside
+// an otherwise byte-identical hardcoded string. No taint tracking can
+// ever find this: there is no source, and the constant IS the finding.
+// Deliberately, UNLIKE `detectCleartextStorage` above, this is immune to
+// `--scramble-identifiers` by construction — the literal `action='http://`
+// text and the word "password" inside a string literal are UNCHANGED by
+// identifier scrambling (only identifier NAMES are rewritten, never
+// string content), so this is a genuinely new, scramble-safe capability,
+// not another instance of that architectural limitation.
+function detectUnprotectedCredTransport(file, raw, ir, analysis, out, seen) {
+  for (const m of ir.methods) {
+    let sawInsecureFormAction = false;
+    let actionLine = null;
+    let sawPasswordField = false;
+    for (const call of m.calls || []) {
+      for (const arg of call.args || []) {
+        const txt = arg.text || '';
+        if (!sawInsecureFormAction && /action\s*=\s*['"]http:\/\/[^'"]*['"]/i.test(txt)) {
+          sawInsecureFormAction = true;
+          actionLine = call.line;
+        }
+        if (!sawPasswordField && /\bpassword\b/i.test(txt)) sawPasswordField = true;
+      }
+      if (sawInsecureFormAction && sawPasswordField) break;
+    }
+    if (!sawInsecureFormAction || !sawPasswordField) continue;
+    const id = `csharp-unprotected-cred-transport:${file}:${actionLine}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(makeFinding({
+      ruleId: 'csharp-unprotected-cred-transport', file, line: actionLine, raw, ir,
+      family: 'insecure-http', severity: 'high', cwe: 'CWE-523',
+      vuln: "Unprotected Transport of Credentials — a login form's action uses http:// instead of https://",
+      remediation: 'Always submit login/credential forms over https:// — a cleartext (http://) form action lets an on-path attacker read the submitted username and password.',
+    }));
+  }
+}
 
-export function scanCSharp(fp, raw) {
-  if (!/\.cs$/i.test(fp)) return [];
-  if (!raw || raw.length > 500_000) return [];
-  let ir, analysis;
-  try {
-    ir = buildCSharpIR(raw);
-    analysis = analyzeCSharpIR(ir);
-  } catch (e) {
-    // IR build failed — fail-closed; better to miss than to throw.
-    return [];
+// CWE-539 (Information Exposure Through Persistent Cookie) — another
+// "point flaw", same shape class as CWE-523 above: Juliet's real C#
+// example (confirmed via the public Juliet mirror this project's
+// manifest pins, CWE539_..._Web_01.cs) sets `cookie.Expires =
+// DateTime.Now.AddDays(1825.00);` (any future/computed expiration makes
+// the cookie PERSISTENT — written to disk, surviving browser restarts)
+// vs. the safe form `cookie.Expires = DateTime.MinValue;` (a session-only
+// cookie, never persisted). No source, no sink, no taint — the RHS
+// EXPRESSION ITSELF is the finding, and (like CWE-523) this is immune to
+// `--scramble-identifiers` by construction: `DateTime.MinValue` is a real
+// BCL member reference, not a user identifier, so it is never rewritten.
+const EXPIRES_SAFE_RHS = /^DateTime\s*\.\s*MinValue$/;
+function detectPersistentCookie(file, raw, ir, analysis, out, seen) {
+  for (const m of ir.methods) {
+    for (const a of m.assignments || []) {
+      if (a.memberPath !== 'Expires') continue;
+      const rhs = (a.rhsText || '').trim();
+      if (!rhs || EXPIRES_SAFE_RHS.test(rhs)) continue;
+      const id = `csharp-persistent-cookie:${file}:${a.line}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      out.push(makeFinding({
+        ruleId: 'csharp-persistent-cookie', file, line: a.line, raw, ir,
+        family: 'header-hardening', severity: 'medium', cwe: 'CWE-539',
+        vuln: 'Information Exposure Through Persistent Cookie — .Expires set to a future/computed date',
+        remediation: 'Set `Expires = DateTime.MinValue` (or omit it) to keep the cookie session-only. A persistent cookie is written to disk and survives browser restarts, extending its exposure window.',
+      }));
+    }
+  }
+}
+
+// SARD_80_F1 W2.8 — CWE-261 (Weak Cryptography for Passwords). A genuine
+// "point flaw" like CWE-523/539 (detectPersistentCookie above): no taint
+// needed, no attacker-controlled input involved at all. The vulnerability
+// is `Convert.FromBase64String(password)` used AS IF it were decryption —
+// Base64 is an ENCODING, not encryption; it carries no key and is
+// trivially reversible by anyone who can read the "encrypted" bytes.
+// Confirmed against the C# public mirror's real corpus shape
+// (`CWE261_Weak_Cryptography_for_Passwords__NetworkCredential_01.cs`):
+// `Bad()` reads a password file then calls
+// `Encoding.UTF8.GetString(Convert.FromBase64String(password))`; `Good()`
+// uses a real cipher (`AesCryptoServiceProvider`) instead and never calls
+// `Convert.FromBase64String` at all — so the bare presence of that call on
+// a password-shaped identifier is itself sufficient, matching CWE-523/539's
+// own "presence of the flawed API = the finding" simplicity (no guard
+// check needed, since the fix is a DIFFERENT API entirely, not a guarded
+// variant of the same one).
+function detectWeakPasswordEncoding(file, raw, ir, analysis, out, seen) {
+  for (const call of ir.calls) {
+    if (call.fullPath !== 'Convert.FromBase64String') continue;
+    const arg = call.args && call.args[0];
+    if (!arg) continue;
+    if (!(arg.idents || []).some((i) => SECRET_NAME_PATTERN.test(i))) continue;
+    const id = `csharp-weak-password-encoding:${file}:${call.line}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.push(makeFinding({
+      ruleId: 'csharp-weak-password-encoding', file, line: call.line, raw, ir,
+      family: 'weak-crypto', severity: 'high', cwe: 'CWE-261',
+      vuln: 'Weak Cryptography for Passwords — Convert.FromBase64String used in place of real decryption',
+      remediation: 'Base64 is an ENCODING, not encryption — it carries no key and is trivially reversible by anyone who can read the encoded bytes. Encrypt stored passwords with a real symmetric cipher (AES-GCM via AesGcm), or better, store only a salted password HASH (PBKDF2/Argon2/bcrypt) and never recover the plaintext at all.',
+    }));
   }
+}
+
+// ─── Entry point ───────────────────────────────────────────────────────────
+
+// SARD_80_F1 W5.31 — split out of `scanCSharp` so `sast/csharp-cross-file.js`
+// can run the exact same detector suite a second time against a re-analyzed
+// `analysis` (one seeded with an externally-tainted parameter from a call in
+// a DIFFERENT file) without duplicating this call list. `scanCSharp` itself
+// is unchanged in behavior — it now just builds the IR/analysis and delegates
+// here, same as before this split.
+export function runCSharpDetectors(fp, raw, ir, analysis) {
   const out = [];
   const seen = new Set();
   try { detectSqlInjection(fp, raw, ir, analysis, out, seen); } catch {}
@@ -912,6 +1424,9 @@ export function scanCSharp(fp, raw) {
   try { detectWeakCrypto(fp, raw, ir, analysis, out, seen); } catch {}
   try { detectWeakRng(fp, raw, ir, analysis, out, seen); } catch {}
   try { detectHardcodedSecret(fp, raw, ir, analysis, out, seen); } catch {}
+  try { detectCleartextStorage(fp, raw, ir, analysis, out, seen); } catch {}
+  try { detectCleartextNetworkCredential(fp, raw, ir, analysis, out, seen); } catch {}
+  try { detectCleartextNetworkSend(fp, raw, ir, analysis, out, seen); } catch {}
   try { detectInsecureCookies(fp, raw, ir, analysis, out, seen); } catch {}
   try { detectXss(fp, raw, ir, analysis, out, seen); } catch {}
   try { detectXssExpanded(fp, raw, ir, analysis, out, seen); } catch {}
@@ -925,6 +1440,9 @@ export function scanCSharp(fp, raw) {
   try { detectXxe(fp, raw, ir, analysis, out, seen); } catch {}
   try { detectXpathInjection(fp, raw, ir, analysis, out, seen); } catch {}
   try { detectInsecureHttp(fp, raw, ir, analysis, out, seen); } catch {}
+  try { detectUnprotectedCredTransport(fp, raw, ir, analysis, out, seen); } catch {}
+  try { detectPersistentCookie(fp, raw, ir, analysis, out, seen); } catch {}
+  try { detectWeakPasswordEncoding(fp, raw, ir, analysis, out, seen); } catch {}
   // Stamp route + auth context on every finding for downstream exploitability.
   for (const f of out) {
     f._routes = analysis.routes.map(r => ({ http: r.http, path: r.path, line: r.line, requiresAuth: r.requiresAuth, methodName: r.methodName }));
@@ -938,4 +1456,18 @@ export function scanCSharp(fp, raw) {
   return out;
 }
 
+export function scanCSharp(fp, raw) {
+  if (!/\.cs$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  let ir, analysis;
+  try {
+    ir = buildCSharpIR(raw);
+    analysis = analyzeCSharpIR(ir);
+  } catch (e) {
+    // IR build failed — fail-closed; better to miss than to throw.
+    return [];
+  }
+  return runCSharpDetectors(fp, raw, ir, analysis);
+}
+
 export { buildCSharpIR, analyzeCSharpIR };