@clear-capabilities/agentic-security-scanner 0.151.2 → 0.152.0

package/src/ir/csharp-ir.js

@@ -47,6 +47,10 @@ const TYPE_MODIFIERS = new Set(['readonly', 'const', 'static', 'public', 'privat
 
 const BUILTIN_TYPES = new Set(['void', 'bool', 'byte', 'sbyte', 'char', 'short', 'ushort', 'int', 'uint', 'long', 'ulong', 'float', 'double', 'decimal', 'string', 'object', 'var', 'dynamic']);
 
+// SARD_80_F1 W4.C11 — compound assignment operators, tokenized as single
+// 'op' tokens by csharp-tokenizer.js but previously never checked for here.
+const CS_COMPOUND_ASSIGN_OPS = new Set(['+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '??=']);
+
 function isType(tok) {
   if (!tok) return false;
   if (tok.kind === 'kw' && BUILTIN_TYPES.has(tok.value)) return true;
@@ -268,7 +272,7 @@ function readMethodHeader(tokens, i, attachedAttrs) {
 }
 
 function walkMethodBody(method) {
-  const out = { calls: [], ctors: [], assignments: [], decls: [], strings: [] };
+  const out = { calls: [], ctors: [], assignments: [], decls: [], strings: [], returns: [] };
   const tokens = method.bodyTokens;
   for (let i = 0; i < tokens.length; i++) {
     const t = tokens[i];
@@ -277,6 +281,45 @@ function walkMethodBody(method) {
       out.strings.push({ kind: t.kind, value: t.value || tokenText([t]), line: t.line, parts: t.parts || null });
       continue;
     }
+    // `return <expr>;` (bare `return;` produces no expr and is skipped —
+    // interprocedural return-taint resolution has nothing to check there).
+    // SARD_80_F1 W3.x: gives `analyzeMethodFlow` visibility into what a
+    // same-file callee actually returns, so a call-shaped assignment RHS
+    // (`data = GoodG2BSource(req, resp);`) can be resolved against the
+    // callee's OWN return taint instead of blindly matching every
+    // identifier NAME in the call text (which wrongly taints on `req`/
+    // `resp` merely being passed as arguments — see the taintMap loop
+    // below and its `_asBareCall`/`resolveCalleeReturnTaint` usage).
+    if (t.kind === 'kw' && t.value === 'return') {
+      let j = i + 1;
+      let depth = 0;
+      while (j < tokens.length && (depth > 0 || tokens[j].kind !== 'semi')) {
+        const tk = tokens[j];
+        if (tk.kind === 'lparen' || tk.kind === 'lbrace' || tk.kind === 'lbracket') depth++;
+        else if (tk.kind === 'rparen' || tk.kind === 'rbrace' || tk.kind === 'rbracket') {
+          // SARD_80_F1 W3.x — an unbalanced closer (depth already 0) closes
+          // an ENCLOSING construct we didn't open (e.g. this `return` sits
+          // inside a `using (...)`/`if (...)` clause with no `;` of its
+          // own before the surrounding `)`), not part of our own
+          // expression — stop here rather than scanning past it into
+          // whatever follows. See the identical fix on the decl/assign/
+          // field loops below for the full incident writeup.
+          if (depth === 0) break;
+          depth--;
+        }
+        j++;
+      }
+      const exprTokens = tokens.slice(i + 1, j);
+      if (exprTokens.length) {
+        out.returns.push({ line: t.line, exprTokens, exprText: tokenText(exprTokens) });
+      }
+      // Deliberately do NOT skip past the expression tokens (`i = j`): the
+      // main loop's own ident/call/assignment branches below still need to
+      // walk them, so a statement-level call inside the return
+      // (`return string.Format(...)`) is still recorded in `out.calls`
+      // exactly as it was before this branch existed.
+      continue;
+    }
     // new Type(args)
     if (t.kind === 'kw' && t.value === 'new') {
       const tr = readType(tokens, i + 1);
@@ -301,8 +344,27 @@ function walkMethodBody(method) {
           let j = tr.next + 2;
           let depth = 0;
           while (j < tokens.length && (depth > 0 || tokens[j].kind !== 'semi')) {
-            if (tokens[j].kind === 'lparen' || tokens[j].kind === 'lbrace' || tokens[j].kind === 'lbracket') depth++;
-            if (tokens[j].kind === 'rparen' || tokens[j].kind === 'rbrace' || tokens[j].kind === 'rbracket') depth--;
+            const tk = tokens[j];
+            if (tk.kind === 'lparen' || tk.kind === 'lbrace' || tk.kind === 'lbracket') depth++;
+            else if (tk.kind === 'rparen' || tk.kind === 'rbrace' || tk.kind === 'rbracket') {
+              // SARD_80_F1 W3.x — a declaration with no `;` of its own,
+              // sitting inside an enclosing `using (Type x = expr)` / `for
+              // (Type x = expr; …)` clause: the FIRST `)` we see here is
+              // that outer construct's own close, not one WE opened (depth
+              // is already 0), so stop before consuming it. Previously this
+              // fell through to `depth--` unconditionally, going negative
+              // and then scanning straight through into the following
+              // block body looking for a `;` that could be arbitrarily far
+              // away — corrupting this decl's rhsText with everything up to
+              // that stray semicolon AND silently absorbing whatever real
+              // statement lived in between (found via SARD_80_F1 W4.C14:
+              // `using (StreamReader sr = new StreamReader("f")) { data =
+              // sr.ReadLine(); }` swallowed the `data = sr.ReadLine()`
+              // assignment into `sr`'s own rhsText, deleting it from
+              // `out.assignments` entirely).
+              if (depth === 0) break;
+              depth--;
+            }
             j++;
           }
           const rhs = tokens.slice(tr.next + 2, j);
@@ -329,12 +391,31 @@ function walkMethodBody(method) {
         targetParts.push(tokens[j + 1].value);
         j += 2;
       }
-      if (tokens[j] && tokens[j].kind === 'op' && tokens[j].value === '=') {
+      // SARD_80_F1 W4.C11 — compound assignment (`+=`, `-=`, …) was
+      // previously invisible here (only bare `=` matched), so a statement
+      // like `cmd.CommandText += "..." + tainted + "...";` — Juliet's own
+      // universal convention for building CommandText — produced NO
+      // assignment record at all, silently dropping it from this
+      // detector's taint model. This model (`analyzeMethodFlow`, see
+      // csharp-analysis.js) has no un-taint step — a taintMap entry is
+      // only ever set true, never cleared — so treating the compound RHS
+      // exactly like a plain assign's RHS is already correct: if the
+      // target was tainted before, that status is never touched (no
+      // clearing branch exists); if this RHS is tainted, it becomes
+      // tainted now, same as a `+=` should.
+      if (tokens[j] && tokens[j].kind === 'op' &&
+          (tokens[j].value === '=' || CS_COMPOUND_ASSIGN_OPS.has(tokens[j].value))) {
         let k = j + 1;
         let depth = 0;
         while (k < tokens.length && (depth > 0 || tokens[k].kind !== 'semi')) {
-          if (tokens[k].kind === 'lparen' || tokens[k].kind === 'lbrace' || tokens[k].kind === 'lbracket') depth++;
-          if (tokens[k].kind === 'rparen' || tokens[k].kind === 'rbrace' || tokens[k].kind === 'rbracket') depth--;
+          const tk = tokens[k];
+          if (tk.kind === 'lparen' || tk.kind === 'lbrace' || tk.kind === 'lbracket') depth++;
+          else if (tk.kind === 'rparen' || tk.kind === 'rbrace' || tk.kind === 'rbracket') {
+            // SARD_80_F1 W3.x — see the decl "typed init" loop above for the
+            // full incident writeup; same enclosing-construct boundary fix.
+            if (depth === 0) break;
+            depth--;
+          }
           k++;
         }
         const rhs = tokens.slice(j + 1, k);
@@ -419,6 +500,7 @@ function walkMethodBody(method) {
   method.ctors = out.ctors;
   method.assignments = out.assignments;
   method.decls = out.decls;
+  method.returns = out.returns;
   method.strings = out.strings;
   return out;
 }
@@ -555,8 +637,15 @@ export function buildCSharpIR(source) {
             if (tokens[f] && tokens[f].kind === 'op' && tokens[f].value === '=') {
               let fj = f + 1, depth = 0;
               while (fj < tokens.length && (depth > 0 || tokens[fj].kind !== 'semi')) {
-                if (tokens[fj].kind === 'lparen' || tokens[fj].kind === 'lbrace' || tokens[fj].kind === 'lbracket') depth++;
-                if (tokens[fj].kind === 'rparen' || tokens[fj].kind === 'rbrace' || tokens[fj].kind === 'rbracket') depth--;
+                const tk = tokens[fj];
+                if (tk.kind === 'lparen' || tk.kind === 'lbrace' || tk.kind === 'lbracket') depth++;
+                else if (tk.kind === 'rparen' || tk.kind === 'rbrace' || tk.kind === 'rbracket') {
+                  // SARD_80_F1 W3.x — see the decl "typed init" loop's
+                  // header comment for the full incident writeup; same
+                  // enclosing-construct boundary fix.
+                  if (depth === 0) break;
+                  depth--;
+                }
                 fj++;
               }
               ir.decls.push({ name: tokens[tr.next].value, type: tr.type, rhsTokens: tokens.slice(f + 1, fj), rhsText: tokenText(tokens.slice(f + 1, fj)), line: tk.line, isVar: false, isField: true });

package/src/ir/index.js

@@ -18,7 +18,9 @@ import {
 import { parseJavaFile } from './parser-java.js';
 import { parseGoFile } from './parser-go.js';
 import { parsePhpFile } from './parser-php.js';
+import { mergePhpIncludes } from './php-include-merge.js';
 import { parseRubyFile } from './parser-rb.js';
+import { parseRustFile } from './parser-rust.js';
 import { parseCppFile, cppExtRe } from './parser-cpp.js';
 import { buildCallGraph } from './callgraph.js';
 import { buildClassHierarchy } from './class-hierarchy.js';
@@ -164,6 +166,9 @@ export function buildProjectIR(fileContents) {
       } else if (/\.rb$/i.test(file)) {
         const ir = parseRubyFile(file, code);
         if (ir) perFile[file] = ir;
+      } else if (/\.rs$/i.test(file)) {
+        const ir = parseRustFile(file, code);
+        if (ir) perFile[file] = ir;
       } else if (cppExtRe().test(file)) {
         const ir = parseCppFile(file, code);
         if (ir) perFile[file] = ir;
@@ -175,6 +180,12 @@ export function buildProjectIR(fileContents) {
       if (ir && ir.file) perFile[ir.file] = ir;
     }
   }
+  // SARD_80_F1 W5.7 — merge PHP include/require targets' top-level
+  // assignments into the includer's own scope before anything else touches
+  // the CFGs (SSA numbering included), since PHP's `include` genuinely
+  // executes in the caller's variable namespace. See php-include-merge.js's
+  // module header for the full rationale and scope.
+  try { mergePhpIncludes(perFile); } catch {}
   if (isSSAEnabled()) {
     for (const ir of Object.values(perFile)) {
       for (const fn of (ir.functions || [])) {
@@ -226,6 +237,9 @@ export async function buildProjectIRAsync(fileContents) {
       } else if (/\.rb$/i.test(file)) {
         const ir = parseRubyFile(file, code);
         if (ir) perFile[file] = ir;
+      } else if (/\.rs$/i.test(file)) {
+        const ir = parseRustFile(file, code);
+        if (ir) perFile[file] = ir;
       } else if (cppExtRe().test(file)) {
         const ir = parseCppFile(file, code);
         if (ir) perFile[file] = ir;
@@ -237,6 +251,12 @@ export async function buildProjectIRAsync(fileContents) {
       if (ir && ir.file) perFile[ir.file] = ir;
     }
   }
+  // SARD_80_F1 W5.7 — merge PHP include/require targets' top-level
+  // assignments into the includer's own scope before anything else touches
+  // the CFGs (SSA numbering included), since PHP's `include` genuinely
+  // executes in the caller's variable namespace. See php-include-merge.js's
+  // module header for the full rationale and scope.
+  try { mergePhpIncludes(perFile); } catch {}
   if (isSSAEnabled()) {
     for (const ir of Object.values(perFile)) {
       for (const fn of (ir.functions || [])) {
@@ -269,4 +289,4 @@ export function parsePythonFile(file, code) {
   return parsePythonFileRegex(file, code);
 }
 
-export { parseJsFile, parseJavaFile, parseCSharpFile, parseKotlinFile, parseGoFile, parsePhpFile, parseRubyFile, parseCppFile, buildCallGraph, buildClassHierarchy, computeSSA, isSSAEnabled, probePythonAvailable, pythonParserDegradation, resetPythonParserDegradation };
+export { parseJsFile, parseJavaFile, parseCSharpFile, parseKotlinFile, parseGoFile, parsePhpFile, parseRubyFile, parseRustFile, parseCppFile, buildCallGraph, buildClassHierarchy, computeSSA, isSSAEnabled, probePythonAvailable, pythonParserDegradation, resetPythonParserDegradation };