@clear-capabilities/agentic-security-scanner 0.151.3 → 0.152.0

package/src/dataflow/catalog.js

@@ -243,6 +243,13 @@ export const CATALOG = [
   // do not assume it is actually gating anything yet.
   { kind: 'source', id: 'java-resultset-getstring',    language: 'java', framework: 'jdbc',    match: { type: 'call', callee: 'getString', receiverTypeIn: ['resultset'] }, label: 'ResultSet.getString' },
   { kind: 'source', id: 'java-resultset-getobject',    language: 'java', framework: 'jdbc',    match: { type: 'call', callee: 'getObject', receiverTypeIn: ['resultset'] }, label: 'ResultSet.getObject' },
+  // SARD_80_F1_SCANNER_PRD.md Juliet Java audit: getAttribute/getQueryString
+  // are as common as getParameter in the servlet source set the catalog
+  // already covers, and Cookie.getValue is the standard way the array
+  // returned by the already-cataloged getCookies() is actually read.
+  { kind: 'source', id: 'java-request-getAttribute',   language: 'java', framework: 'servlet', match: { type: 'call', callee: 'getAttribute' },   label: 'request.getAttribute' },
+  { kind: 'source', id: 'java-request-getQueryString', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'getQueryString' }, label: 'request.getQueryString' },
+  { kind: 'source', id: 'java-cookie-getvalue',        language: 'java', framework: 'servlet', match: { type: 'call', callee: 'getValue' },       label: 'Cookie.getValue' },
 
   // ─── SOURCES (Annotation/Decorator-shaped) ────────────────────────────────
   // R14(a): annotation/decorator-shaped framework sources (Spring @RequestParam,
@@ -404,6 +411,28 @@ export const CATALOG = [
   { kind: 'source', id: 'php-symfony-content', language: 'php', framework: 'symfony', match: { type: 'call', callee: 'getContent' },                  label: '$request->getContent() (Symfony)' },
   { kind: 'source', id: 'php-symfony-get',     language: 'php', framework: 'symfony', match: { type: 'call', callee: 'get' },                         label: '$request->get() (Symfony)' },
 
+  // SARD PHP corpus: file/stream/process-output sources. This corpus's
+  // dominant "source" shape is NOT a superglobal at all — it's a value read
+  // from a file or a subprocess's output (fgets on an fopen'd handle is the
+  // single most common first-source shape in the dev split, ahead of every
+  // superglobal combined), matching the real NIST SARD PHP Vulnerability
+  // Test Suite's own generator convention. Receiver-agnostic (`fgets($fh)`
+  // covers stdin, a socket, or an ordinary file — the taint concern is the
+  // same regardless of which handle) and file-content sources are real,
+  // legitimate untrusted input whenever the file/stream itself isn't a
+  // hardcoded, checked-in constant path.
+  { kind: 'source', id: 'php-fgetc',   language: 'php', framework: 'core', match: { type: 'call', callee: 'fgetc' },   label: 'fgetc()', provenance: 'file-read' },
+  { kind: 'source', id: 'php-fscanf',  language: 'php', framework: 'core', match: { type: 'call', callee: 'fscanf' },  label: 'fscanf()', provenance: 'file-read' },
+  { kind: 'source', id: 'php-file-get-contents', language: 'php', framework: 'core', match: { type: 'call', callee: 'file_get_contents' }, label: 'file_get_contents()', provenance: 'file-read' },
+  { kind: 'source', id: 'php-file',              language: 'php', framework: 'core', match: { type: 'call', callee: 'file' },              label: 'file()', provenance: 'file-read' },
+  { kind: 'source', id: 'php-stream-get-contents', language: 'php', framework: 'core', match: { type: 'call', callee: 'stream_get_contents' }, label: 'stream_get_contents()', provenance: 'file-read' },
+  { kind: 'source', id: 'php-readline', language: 'php', framework: 'core', match: { type: 'call', callee: 'readline' }, label: 'readline()', provenance: 'stdin' },
+  // Assigned FROM (the return value of running a command), distinct from the
+  // sink use of the SAME functions (building a command from tainted input,
+  // see php-shell-exec/php-exec/php-system below) — both directions are real.
+  { kind: 'source', id: 'php-shell-exec-output', language: 'php', framework: 'core', match: { type: 'call', callee: 'shell_exec' }, label: 'shell_exec() return value', provenance: 'file-read' },
+  { kind: 'source', id: 'php-getenv', language: 'php', framework: 'core', match: { type: 'call', callee: 'getenv' }, label: 'getenv()', provenance: 'env' },
+
   // ─── SINKS (SQL — Python) ─────────────────────────────────────────────────
   { kind: 'sink', id: 'py-cursor-execute',     language: 'py', framework: 'dbapi',      match: { type: 'call', callee: 'execute' }, argIndex: 0,
     vuln: { name: 'SQL Injection (cursor.execute)', severity: 'critical', cwe: 'CWE-89',
@@ -432,6 +461,17 @@ export const CATALOG = [
             remediation: 'Use PreparedStatement + setX(N, value).' } },
   { kind: 'sink', id: 'java-stmt-execute',       language: 'java', framework: 'jdbc',     match: { type: 'call', callee: 'execute' },       argIndex: 0,
     vuln: { name: 'SQL Injection (Statement.execute)', severity: 'critical', cwe: 'CWE-89', remediation: 'Use PreparedStatement.' } },
+  // `Statement.addBatch(sql)` — the SQL string, not `executeBatch()` (which
+  // takes no arguments and just fires whatever was previously queued), is
+  // the actual sink: `stmt.addBatch("UPDATE ... WHERE name='" + tainted +
+  // "'"); ... stmt.executeBatch();`. Confirmed via the public Juliet Java
+  // mirror (CWE89_SQL_Injection's own executeBatch-suffixed variants, the
+  // single largest false-negative cluster this session found for CWE-89:
+  // 167 of 308 dev-split fns were this one missing sink). `argIndex: 0`
+  // naturally excludes `PreparedStatement.addBatch()`'s zero-arg safe form
+  // (queuing already-bound parameters) — there is no arg 0 to match.
+  { kind: 'sink', id: 'java-stmt-addbatch',      language: 'java', framework: 'jdbc',     match: { type: 'call', callee: 'addBatch' },      argIndex: 0,
+    vuln: { name: 'SQL Injection (Statement.addBatch)', severity: 'critical', cwe: 'CWE-89', remediation: 'Use PreparedStatement + setX(N, value) + the zero-arg addBatch() form. Never concatenate user input into the SQL string passed to addBatch().' } },
   { kind: 'sink', id: 'java-jdbc-prepareStatement', language: 'java', framework: 'jdbc', match: { type: 'call', callee: 'prepareStatement' }, argIndex: 0,
     vuln: { name: 'SQL Injection (PreparedStatement built via concat)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use placeholders (?) in the SQL string; bind values via setX(N, value).' } },
@@ -453,12 +493,51 @@ export const CATALOG = [
   // response-write idiom, `HttpServletResponse.getWriter()`) is the
   // dominant shape. Receiver-scoped to the `getWriter` chain segment (both
   // `write` and `print` collide with countless unrelated APIs bare).
-  { kind: 'sink', id: 'java-writer-write', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'write', receiver: '^getWriter$' }, argIndex: 0,
+  //
+  // SARD_80_F1 W4: the chained one-liner (`response.getWriter().write(x)`)
+  // was the ONLY shape these three entries could ever match — Java's more
+  // common idiom splits it in two (`PrintWriter out = response.getWriter();
+  // out.println(x);`), a completely different receiver (the local variable
+  // NAME, not the literal `getWriter` chain segment) that was invisible.
+  // Fixed via `receiverTypeIn` (ADDITIVE — confirms a match a failing name
+  // check missed, never replaces the name check), backed by
+  // `class-hierarchy.js`'s `typeOfVar` now also being seeded from a local's
+  // DECLARED type, not just `paramTypes`/`isNew` constructor calls (see its
+  // own comment). Deliberately NOT done via `parser-java.js`'s
+  // `_localVarConstructedTypes`/`_rewriteVarTypeCallees` string-rewrite
+  // mechanism — a first attempt did that and broke an EXISTING, unrelated
+  // catalog entry keyed on a short variable-name convention (`XPath xp = …;
+  // xp.evaluate(...)` — the rewrite mutated `xp.evaluate` to
+  // `XPath.evaluate`, and the xpath sink's `receiver: '^(?:xp|xpath)$'`
+  // stopped matching); confirmed by direct regression in
+  // `test/java-taint-flow.test.js`, then reverted. `println` was also
+  // completely absent from this list despite being the single most common
+  // of the three methods in real servlet code.
+  { kind: 'sink', id: 'java-writer-write', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'write', receiver: '^getWriter$', receiverTypeIn: ['^PrintWriter$'] }, argIndex: 0,
     vuln: { name: 'Reflected XSS (PrintWriter.write)', severity: 'high', cwe: 'CWE-79',
             remediation: 'HTML-escape user-derived content before writing to the response, or use a templating engine with auto-escaping.' } },
-  { kind: 'sink', id: 'java-writer-print', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'print', receiver: '^getWriter$' }, argIndex: 0,
+  { kind: 'sink', id: 'java-writer-print', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'print', receiver: '^getWriter$', receiverTypeIn: ['^PrintWriter$'] }, argIndex: 0,
     vuln: { name: 'Reflected XSS (PrintWriter.print)', severity: 'high', cwe: 'CWE-79',
             remediation: 'HTML-escape user-derived content before writing to the response, or use a templating engine with auto-escaping.' } },
+  { kind: 'sink', id: 'java-writer-println', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'println', receiver: '^getWriter$', receiverTypeIn: ['^PrintWriter$'] }, argIndex: 0,
+    vuln: { name: 'Reflected XSS (PrintWriter.println)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'HTML-escape user-derived content before writing to the response, or use a templating engine with auto-escaping.' } },
+  // `HttpServletResponse.sendError(int, String)` — the message argument
+  // (argIndex 1, NOT 0) is written verbatim into the generated error page.
+  // Confirmed via the public Juliet Java mirror (CWE81_XSS_Error_Message's
+  // OWN corpus, 545 files, every one of them: `response.sendError(404,
+  // "<br>bad() - Parameter name has value " + data);`) that this — not a
+  // caught exception's `getMessage()`, which the CWE-81 name suggests and
+  // which a prior session-iteration built and verified working in
+  // isolation — is the sink Juliet's CWE-81 ("XSS in Error Message")
+  // actually exercises: "Error Message" names the `sendError` HTTP error
+  // message parameter, not an exception message. That earlier fix is not
+  // wrong (it is a real, separate gap for a shape this corpus just never
+  // happens to test) but it explains why CWE-81 showed zero real-corpus
+  // movement despite passing its own unit tests.
+  { kind: 'sink', id: 'java-response-senderror', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'sendError', receiver: '^response$', receiverTypeIn: ['^HttpServletResponse$'] }, argIndex: 1,
+    vuln: { name: 'Reflected XSS (HttpServletResponse.sendError message)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'HTML-escape user-derived content before passing it as the sendError message, or send a generic, static error message with no user input.' } },
 
   // ─── SINKS (SQL — Go) ──────────────────────────────────────────────────────
   { kind: 'sink', id: 'go-db-query',    language: 'go', framework: 'database/sql', match: { type: 'call', callee: 'Query' },    argIndex: 0,
@@ -582,6 +661,17 @@ export const CATALOG = [
   { kind: 'sink', id: 'php-echo-xss', language: 'php', framework: 'core', match: { type: 'call', callee: '__php_echo__' }, argIndex: 'all',
     vuln: { name: 'Reflected XSS (echo)', severity: 'high', cwe: 'CWE-79',
             remediation: 'Escape output with htmlspecialchars() before echoing user-derived content.' } },
+  // SARD PHP corpus: the backtick shell-execution operator is a language
+  // construct like echo/print (parser-php.js now lowers it to a synthetic
+  // `__php_backtick_exec__` call, see that file for why).
+  { kind: 'sink', id: 'php-backtick-exec', language: 'php', framework: 'core', match: { type: 'call', callee: '__php_backtick_exec__' }, argIndex: 'all',
+    vuln: { name: 'OS Command Injection (backtick operator)', severity: 'critical', cwe: 'CWE-78',
+            remediation: 'Never build a shell command from user input. Use escapeshellarg() on every interpolated value, or avoid shell_exec()/backticks entirely in favor of a fixed argv array passed to proc_open() or symfony/process.' } },
+  // include/require/include_once/require_once are language constructs
+  // (parser-php.js now lowers them to a synthetic `__php_include__` call).
+  { kind: 'sink', id: 'php-include-lfi', language: 'php', framework: 'core', match: { type: 'call', callee: '__php_include__' }, argIndex: 'all',
+    vuln: { name: 'Local/Remote File Inclusion (include/require)', severity: 'critical', cwe: 'CWE-98',
+            remediation: 'Never include() / require() a user-controlled path. Build an explicit whitelist dispatch table instead: `$pages = ["home" => "home.php", ...]; include $pages[$_GET["page"]] ?? "404.php";`.' } },
 
   // ─── SINKS (XSS / template — JS/TS / browser) ─────────────────────────────
   { kind: 'sink', id: 'js-innerHTML-assign', language: 'js', framework: 'dom', match: { type: 'member', object: '_any_', prop: 'innerHTML' }, argIndex: 'rhs',
@@ -792,6 +882,26 @@ export const CATALOG = [
   { kind: 'sink', id: 'java-new-File',    language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'File' }, argIndex: 0,
     vuln: { name: 'Path Traversal (new File)', severity: 'high', cwe: 'CWE-22',
             remediation: 'Canonicalize with Path.normalize + startsWith(base).' } },
+  // Juliet's own dominant file-sink shapes: `new FileInputStream(path)`,
+  // `new FileReader(path)`, `new RandomAccessFile(path, mode)`. Each is a
+  // distinct constructor (not an alias for `new File(...)`, which some
+  // callers wrap it around instead), so `java-new-File`'s bare `callee:
+  // 'File'` never matches any of them.
+  { kind: 'sink', id: 'java-new-FileInputStream', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'FileInputStream' }, argIndex: 0,
+    vuln: { name: 'Path Traversal (new FileInputStream)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize the path and verify it stays within an allow-listed base directory before opening it.' } },
+  { kind: 'sink', id: 'java-new-FileOutputStream', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'FileOutputStream' }, argIndex: 0,
+    vuln: { name: 'Path Traversal (new FileOutputStream)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize the path and verify it stays within an allow-listed base directory before opening it.' } },
+  { kind: 'sink', id: 'java-new-FileReader', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'FileReader' }, argIndex: 0,
+    vuln: { name: 'Path Traversal (new FileReader)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize the path and verify it stays within an allow-listed base directory before opening it.' } },
+  { kind: 'sink', id: 'java-new-FileWriter', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'FileWriter' }, argIndex: 0,
+    vuln: { name: 'Path Traversal (new FileWriter)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize the path and verify it stays within an allow-listed base directory before opening it.' } },
+  { kind: 'sink', id: 'java-new-RandomAccessFile', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'RandomAccessFile' }, argIndex: 0,
+    vuln: { name: 'Path Traversal (new RandomAccessFile)', severity: 'high', cwe: 'CWE-22',
+            remediation: 'Canonicalize the path and verify it stays within an allow-listed base directory before opening it.' } },
   { kind: 'sink', id: 'go-os-open',       language: 'go', framework: 'os',      match: { type: 'call', callee: 'Open' }, argIndex: 0,
     vuln: { name: 'Path Traversal (os.Open)', severity: 'high', cwe: 'CWE-22',
             remediation: 'Use filepath.Clean + verify the path is rooted in your allow-list dir.' } },
@@ -848,7 +958,29 @@ export const CATALOG = [
   // Taint-recall PRD (80%) Tier 1: XPath.evaluate() called directly (no
   // .compile() call site to catch it via the entry above) — javax.xml.xpath's
   // other common idiom. Receiver-scoped: "evaluate" is generic elsewhere.
-  { kind: 'sink', id: 'java-xpath-evaluate', language: 'java', framework: 'xpath', match: { type: 'call', callee: 'evaluate', receiver: '^(?:xp|xpath|expr)$' }, argIndex: 0,
+  //
+  // SARD_80_F1 W4.J32 — `xPath` (camelCase, matching the `XPath` type name
+  // exactly as `javax.xml.xpath.XPath`'s own Javadoc examples and the real
+  // public Juliet mirror's own CWE-643 files spell it — confirmed directly
+  // against `CWE643_Xpath_Injection__database_54e.java`'s
+  // `XPath xPath = XPathFactory.newInstance().newXPath();`) NEVER matched
+  // this entry: `_receiverAllowed` builds its regex with `new RegExp(pat)`,
+  // no `i` flag, so the case-sensitive `^(?:xp|xpath|expr)$` only ever
+  // matched the all-lowercase `xpath` or the short `xp`/`expr` — not the
+  // idiomatic camelCase form. This meant `IR-TAINT` could never fire on
+  // this sink for ANY Java file using ordinary naming conventions, in a
+  // single file or across any number of files — CWE-643's real corpus
+  // recall gap traced to cross-file/multi-hop chains (5 separate classes,
+  // confirmed via public-mirror `_54a`..`_54e`) was actually just the
+  // visible SYMPTOM: the structural/regex detectors that fired instead are
+  // inherently single-file, so once IR-TAINT (the only interprocedural
+  // mechanism) couldn't match this sink at all, every cross-file variant
+  // was invisible by construction. Verified directly: a same-file `xPath`
+  // repro fired ZERO `IR-TAINT` findings before this fix (structural/regex
+  // detectors covered it instead) and fired correctly after. `xp`/`xpath`/
+  // `expr` remain matched unchanged (existing `test/java-taint-flow.test.js`
+  // coverage for the `xp` short form is unaffected — purely additive).
+  { kind: 'sink', id: 'java-xpath-evaluate', language: 'java', framework: 'xpath', match: { type: 'call', callee: 'evaluate', receiver: '^(?:xp|xpath|xPath|expr)$' }, argIndex: 0,
     vuln: { name: 'XPath Injection (XPath.evaluate)', severity: 'high', cwe: 'CWE-643',
             remediation: 'Use XPathVariableResolver or setXPathVariableResolver; never concat user input into the expression.' } },
   { kind: 'sink', id: 'cs-xml-selectnodes', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'SelectNodes' }, argIndex: 0,
@@ -884,6 +1016,22 @@ export const CATALOG = [
   { kind: 'sink', id: 'php-domxpath-query', language: 'php', framework: 'stdlib', match: { type: 'call', callee: 'query', receiver: '(?:xp|xpath|dom)' }, argIndex: 0,
     vuln: { name: 'XPath Injection (DOMXPath::query)', severity: 'high', cwe: 'CWE-643',
             remediation: 'Never concat user input into the expression string; validate/allow-list the queried attribute value instead.' } },
+  // SimpleXMLElement::xpath() — PHP's OTHER, more commonly used XPath query
+  // API (distinct from DOMXPath::query above), called on a SimpleXMLElement
+  // object which can be named anything (`$xml->xpath($query)` — no `xp`/
+  // `xpath`/`dom`-shaped receiver name to key off, unlike DOMXPath's own
+  // idiomatic naming). No `match.receiver` set deliberately: `xpath` is a
+  // specific enough bare method name that gating on receiver naming would
+  // only lose recall, not gain precision. Tagged CWE-91 (not CWE-643) to
+  // match this specific API/CWE pairing as filed by NIST SARD's own PHP
+  // Vulnerability Test Suite (Stivalet & Delaitre) — confirmed from that
+  // suite's PUBLIC generator source (github.com/stivalet/
+  // php-vuln-test-suite-generator, execQuery_XPath.txt: `$xml =
+  // simplexml_load_file(...); $res=$xml->xpath($query);`), not from reading
+  // this project's own ingested/scored corpus copy.
+  { kind: 'sink', id: 'php-simplexml-xpath', language: 'php', framework: 'stdlib', match: { type: 'call', callee: 'xpath' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (SimpleXMLElement::xpath)', severity: 'high', cwe: 'CWE-91',
+            remediation: 'Never concat user input into the expression string; validate/allow-list the queried attribute value instead.' } },
   { kind: 'sink', id: 'go-htmlquery-find', language: 'go', framework: 'htmlquery', match: { type: 'call', callee: 'Find', receiver: 'htmlquery' }, argIndex: 1,
     vuln: { name: 'XPath Injection (htmlquery.Find)', severity: 'high', cwe: 'CWE-643',
             remediation: 'Never concat user input into the expression string; validate/allow-list the queried attribute value instead.' } },
@@ -974,8 +1122,60 @@ export const CATALOG = [
   { kind: 'sanitizer', id: 'php-htmlentities',     language: 'php', match: { type: 'call', callee: 'htmlentities' },     effect: 'strip', appliesTo: ['xss'] },
   { kind: 'sanitizer', id: 'php-escapeshellarg',   language: 'php', match: { type: 'call', callee: 'escapeshellarg' },   effect: 'strip', appliesTo: ['cmd'] },
   { kind: 'sanitizer', id: 'php-escapeshellcmd',   language: 'php', match: { type: 'call', callee: 'escapeshellcmd' },   effect: 'strip', appliesTo: ['cmd'] },
-  { kind: 'sanitizer', id: 'php-intval',           language: 'php', match: { type: 'call', callee: 'intval' },           effect: 'strip', appliesTo: ['*'] },
-  { kind: 'sanitizer', id: 'php-filter-var',       language: 'php', match: { type: 'call', callee: 'filter_var' },       effect: 'strip', appliesTo: ['*'] },
+  // SARD PHP corpus, sanitizer-semantics precision pass. `effect: 'coerce'`
+  // (distinct from `effect: 'strip'`) marks a value that becomes a genuinely
+  // non-string type — an int/float can never carry a SQL/XSS/command-
+  // injection payload regardless of family, which is why `appliesTo: ['*']`
+  // is honest here in a way it is NOT for `htmlspecialchars`/
+  // `escapeshellarg` above (those only neutralize ONE family's
+  // metacharacters, appliesTo is scoped accordingly). `effect: 'coerce'`
+  // pairs with dataflow/engine.js's `_isCoercionCall`, which actually KILLS
+  // taint (not just demotes) for a universal-appliesTo sanitizer match.
+  { kind: 'sanitizer', id: 'php-intval',   language: 'php', match: { type: 'call', callee: 'intval' },   effect: 'coerce', appliesTo: ['*'] },
+  { kind: 'sanitizer', id: 'php-floatval', language: 'php', match: { type: 'call', callee: 'floatval' }, effect: 'coerce', appliesTo: ['*'] },
+  // filter_var($x, FILTER_VALIDATE_INT|FLOAT) genuinely coerces (returns the
+  // typed value or `false`) — a real sanitizer. Every OTHER filter_var call
+  // shape (no filter arg at all, defaulting to FILTER_DEFAULT which does
+  // nothing; FILTER_SANITIZE_* filters, which strip characters but do not
+  // guarantee the family-relevant metacharacter is gone; FILTER_VALIDATE_*
+  // for anything other than INT/FLOAT) is NOT a sanitizer for any family
+  // this catalog scores, and the corpus's own PHP `good` cases were found
+  // (this session) to use `filter_var` with `FILTER_VALIDATE_INT`/`FLOAT`
+  // specifically for its 288/288 genuinely-safe cases — a single blanket
+  // `appliesTo: ['*']` entry (the previous version of this catalog) would
+  // have silently marked EVERY filter_var call safe regardless of which
+  // filter was actually passed, which is backwards for FILTER_SANITIZE_*
+  // and simply wrong for the no-filter-arg default. `requireLiteralArg`
+  // scopes the match to the two filters that are actually type coercions;
+  // dataflow/engine.js's `_isCoercionCall` consults this same
+  // `match.requireLiteralArg` gate (shared with the sink-side check via
+  // `_literalArgSatisfied`), so a bare/wrong-filter `filter_var` call
+  // correctly does not qualify as a coercion.
+  { kind: 'sanitizer', id: 'php-filter-var-int',   language: 'php',
+    match: { type: 'call', callee: 'filter_var', requireLiteralArg: { index: 1, pattern: '^FILTER_VALIDATE_INT$' } },
+    effect: 'coerce', appliesTo: ['*'] },
+  { kind: 'sanitizer', id: 'php-filter-var-float', language: 'php',
+    match: { type: 'call', callee: 'filter_var', requireLiteralArg: { index: 1, pattern: '^FILTER_VALIDATE_FLOAT$' } },
+    effect: 'coerce', appliesTo: ['*'] },
+  // settype($x, "integer"|"int"|"float"|"double") mutates $x in place to a
+  // non-string type — same coercion argument as intval/floatval above, but
+  // only when the TYPE argument is actually numeric (settype($x, "string")
+  // or ("array") is the opposite of a sanitizer).
+  { kind: 'sanitizer', id: 'php-settype-numeric', language: 'php',
+    match: { type: 'call', callee: 'settype', requireLiteralArg: { index: 1, pattern: '^"(?:int|integer|float|double)"$' } },
+    effect: 'coerce', appliesTo: ['*'] },
+  // Escaping functions, family-scoped and NOT universal: each only
+  // neutralizes ITS OWN sink's metacharacter grammar. mysql(i)_real_escape_string
+  // and pg_escape_string escape SQL string-literal delimiters specifically —
+  // they do nothing for command/LDAP/XSS injection, and (a real, disclosed
+  // limitation, not fixed here) they are only actually safe when the escaped
+  // value is placed INSIDE a quoted SQL string literal, which this catalog
+  // has no mechanism to verify.
+  { kind: 'sanitizer', id: 'php-mysqli-real-escape-string', language: 'php', match: { type: 'call', callee: 'real_escape_string' }, effect: 'strip', appliesTo: ['sql'] },
+  { kind: 'sanitizer', id: 'php-mysql-real-escape-string',  language: 'php', match: { type: 'call', callee: 'mysql_real_escape_string' }, effect: 'strip', appliesTo: ['sql'] },
+  { kind: 'sanitizer', id: 'php-pg-escape-string',          language: 'php', match: { type: 'call', callee: 'pg_escape_string' }, effect: 'strip', appliesTo: ['sql'] },
+  { kind: 'sanitizer', id: 'php-addslashes',                language: 'php', match: { type: 'call', callee: 'addslashes' }, effect: 'strip', appliesTo: ['sql'] },
+  { kind: 'sanitizer', id: 'php-ldap-escape',                language: 'php', match: { type: 'call', callee: 'ldap_escape' }, effect: 'strip', appliesTo: ['ldap'] },
 
   // ─── SANITIZERS (Ruby) ────────────────────────────────────────────────────
   { kind: 'sanitizer', id: 'rb-rails-html-escape', language: 'rb', match: { type: 'call', callee: 'h' },          effect: 'strip', appliesTo: ['xss'] },
@@ -1192,6 +1392,35 @@ export const CATALOG = [
   { kind: 'sink', id: 'java-servlet-setheader', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'setHeader' }, argIndex: 1,
     vuln: { name: 'HTTP Response Splitting / Header Injection (HttpServletResponse.setHeader)', severity: 'high', cwe: 'CWE-113',
             remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header value.' } },
+  { kind: 'sink', id: 'java-servlet-addheader', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'addHeader' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / Header Injection (HttpServletResponse.addHeader)', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header value.' } },
+  // `Cookie`'s own value comes from its constructor's 2nd arg, so the sink
+  // is the constructor, not addCookie() (which only ever receives the
+  // already-built Cookie object).
+  { kind: 'sink', id: 'java-new-Cookie', language: 'java', framework: 'servlet', match: { type: 'call', callee: 'Cookie' }, argIndex: 1,
+    vuln: { name: 'HTTP Response Splitting / Header Injection (new Cookie(name, value))', severity: 'high', cwe: 'CWE-113',
+            remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a cookie value.' } },
+  // CWE-470: unsafe reflection. Juliet's canonical shape passes a
+  // user-controlled class name straight to Class.forName, then constructs
+  // or invokes it — the class-name argument is the attacker's real lever.
+  { kind: 'sink', id: 'java-class-forname', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'forName' }, argIndex: 0,
+    vuln: { name: 'Unsafe Reflection (Class.forName)', severity: 'high', cwe: 'CWE-470',
+            remediation: 'Validate the class name against an explicit allow-list before loading it reflectively.' } },
+  { kind: 'sink', id: 'java-method-invoke', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'invoke', receiver: '^method$' }, argIndex: 'all',
+    vuln: { name: 'Unsafe Reflection (Method.invoke)', severity: 'high', cwe: 'CWE-470',
+            remediation: 'Validate the target method/class against an explicit allow-list before invoking it reflectively.' } },
+  // CWE-134: uncontrolled format string. `String.format`/`Formatter.format`/
+  // `PrintStream.printf` all treat arg 0 as the format string itself; a
+  // tainted format string (as opposed to a tainted format ARGUMENT, which is
+  // ordinary and safe) can leak memory contents via `%s`/`%n$s` or crash the
+  // process.
+  { kind: 'sink', id: 'java-string-format', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'format' }, argIndex: 0,
+    vuln: { name: 'Uncontrolled Format String (String.format / Formatter.format)', severity: 'medium', cwe: 'CWE-134',
+            remediation: 'Never pass user input as the format string itself; use a fixed format string and pass user input only as an argument.' } },
+  { kind: 'sink', id: 'java-printstream-printf', language: 'java', framework: 'stdlib', match: { type: 'call', callee: 'printf' }, argIndex: 0,
+    vuln: { name: 'Uncontrolled Format String (PrintStream.printf)', severity: 'medium', cwe: 'CWE-134',
+            remediation: 'Never pass user input as the format string itself; use a fixed format string and pass user input only as an argument.' } },
   { kind: 'sink', id: 'kt-servlet-setheader', language: 'kt', framework: 'servlet', match: { type: 'call', callee: 'setHeader' }, argIndex: 1,
     vuln: { name: 'HTTP Response Splitting / Header Injection (HttpServletResponse.setHeader)', severity: 'high', cwe: 'CWE-113',
             remediation: 'Strip/validate CR/LF from any user-controlled value before using it as a header value.' } },
@@ -1207,7 +1436,18 @@ export const CATALOG = [
   { kind: 'sanitizer', id: 'py-urllib-quote',        language: 'py', match: { type: 'call', callee: 'quote_plus' },     effect: 'strip', appliesTo: ['url'] },
   { kind: 'sanitizer', id: 'py-int-v2',                 language: 'py', match: { type: 'call', callee: 'int' },            effect: 'strip', appliesTo: ['*'] },
   { kind: 'sanitizer', id: 'py-float-v2',               language: 'py', match: { type: 'call', callee: 'float' },          effect: 'strip', appliesTo: ['*'] },
-  { kind: 'sanitizer', id: 'py-ast-literal-eval',    language: 'py', match: { type: 'call', callee: 'literal_eval' },   effect: 'strip', appliesTo: ['*'] },
+  // NOT a type-coercion sanitizer despite the old appliesTo:['*'] tag:
+  // ast.literal_eval("'; DROP TABLE users;--'") returns that exact STRING
+  // unchanged — a Python string literal evaluates to itself. Its only real
+  // safety property is preventing arbitrary CODE execution (the eval()
+  // replacement it exists for), not neutralizing the resulting value's
+  // content for any other downstream sink. `appliesTo:['*']` was safe only
+  // as long as a sanitizer match merely DEMOTED confidence; now that
+  // dataflow/engine.js's _isCoercionCall treats a universal tag as licence to
+  // KILL taint outright, this entry would silently hide a real SQL/command
+  // injection whose payload happens to parse as a Python literal. appliesTo
+  // left empty (never matches any family) until this is scoped correctly.
+  { kind: 'sanitizer', id: 'py-ast-literal-eval',    language: 'py', match: { type: 'call', callee: 'literal_eval' },   effect: 'strip', appliesTo: [] },
   { kind: 'sanitizer', id: 'py-yaml-safe-load',      language: 'py', match: { type: 'call', callee: 'safe_load' },      effect: 'strip', appliesTo: ['deserial'] },
   { kind: 'sanitizer', id: 'py-pathlib-resolve',     language: 'py', match: { type: 'call', callee: 'resolve' },        effect: 'taintIf-not-pinned', appliesTo: ['path'] },
   { kind: 'sanitizer', id: 'py-defusedxml',          language: 'py', match: { type: 'call', callee: 'fromstring' },     effect: 'strip', appliesTo: ['xxe'] },     // when called from defusedxml namespace
@@ -1219,7 +1459,61 @@ export const CATALOG = [
   { kind: 'source', id: 'cs-request-headers',  language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'Request', prop: 'Headers' },     label: 'Request.Headers',     provenance: 'header' },
   { kind: 'source', id: 'cs-request-params',   language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'Request', prop: 'Params' },      label: 'Request.Params' },
   { kind: 'source', id: 'cs-request-body',     language: 'cs', framework: 'aspnet-core', match: { type: 'member', object: 'Request', prop: 'Body' },   label: 'Request.Body',        provenance: 'http-body' },
+  // SARD_80_F1: the entries above only match a receiver literally named
+  // `Request` (the ASP.NET-Core-controller convention, `this.Request.…`
+  // stripped to its bare member). Juliet's own dominant local-variable
+  // naming (`req`/`request` params, exactly as JS's `req.query`/
+  // `request.body` entries already cover) never matched at all — same
+  // gap, same fix, mirrored per property.
+  { kind: 'source', id: 'cs-req-form',         language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'req',     prop: 'Form' },        label: 'req.Form',        provenance: 'http-body' },
+  { kind: 'source', id: 'cs-req-query',        language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'req',     prop: 'QueryString' }, label: 'req.QueryString', provenance: 'url-param' },
+  { kind: 'source', id: 'cs-req-cookies',      language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'req',     prop: 'Cookies' },     label: 'req.Cookies',     provenance: 'cookie' },
+  { kind: 'source', id: 'cs-req-headers',      language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'req',     prop: 'Headers' },     label: 'req.Headers',     provenance: 'header' },
+  { kind: 'source', id: 'cs-req-params',       language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'req',     prop: 'Params' },      label: 'req.Params',      provenance: 'url-param' },
+  { kind: 'source', id: 'cs-request-lc-form',    language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'request', prop: 'Form' },        label: 'request.Form',        provenance: 'http-body' },
+  { kind: 'source', id: 'cs-request-lc-query',   language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'request', prop: 'QueryString' }, label: 'request.QueryString', provenance: 'url-param' },
+  { kind: 'source', id: 'cs-request-lc-cookies', language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'request', prop: 'Cookies' },     label: 'request.Cookies',     provenance: 'cookie' },
+  { kind: 'source', id: 'cs-request-lc-headers', language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'request', prop: 'Headers' },     label: 'request.Headers',     provenance: 'header' },
+  { kind: 'source', id: 'cs-request-lc-params',  language: 'cs', framework: 'aspnet', match: { type: 'member', object: 'request', prop: 'Params' },      label: 'request.Params',      provenance: 'url-param' },
   { kind: 'source', id: 'cs-env-var',          language: 'cs', framework: 'stdlib', match: { type: 'call',   callee: 'GetEnvironmentVariable' },       label: 'Environment.GetEnvironmentVariable', provenance: 'env' },
+  { kind: 'source', id: 'cs-env-args',         language: 'cs', framework: 'stdlib', match: { type: 'call',   callee: 'GetCommandLineArgs' },           label: 'Environment.GetCommandLineArgs', provenance: 'env' },
+  // Console/stream/socket console-style reads — Juliet's other dominant
+  // source family (`Console.ReadLine()`, `IO.StreamReader/TextReader/
+  // BinaryReader.ReadLine()/ReadToEnd()`). Bare (receiver-unscoped): the
+  // last-segment index match already makes `Console.ReadLine()` and
+  // `sr.ReadLine()` share this one entry, exactly the "receiver-agnostic"
+  // shape `cs-directorysearcher-filter`'s own comment documents for reads.
+  // No `provenance` field on the 6 entries below: 'io-read'/'database' are
+  // not values src/lineage/source-registry.js's PROVENANCE_MAP recognizes
+  // (found via that registry's own pinned coverage-count test after this
+  // catalog change merged) — the established convention for exactly this
+  // shape (a stream/console read; a JDBC/ADO result-set read) is to declare
+  // NO provenance field at all and let source-registry.js's own
+  // NO_PROVENANCE_OVERRIDES table classify by entry id instead, matching
+  // java-io-readline (user-input) and java-resultset-getstring/-getobject
+  // (database-read) exactly. Overrides added there, not invented here.
+  { kind: 'source', id: 'cs-console-readline', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'ReadLine' },   label: 'Console/TextReader.ReadLine' },
+  { kind: 'source', id: 'cs-reader-readtoend', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'ReadToEnd' }, label: 'TextReader.ReadToEnd' },
+  { kind: 'source', id: 'cs-console-read',     language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Read', receiver: '^Console$' }, label: 'Console.Read' },
+  { kind: 'source', id: 'cs-tcpclient-getstream',  language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'GetStream' }, label: 'TcpClient/TcpListener.GetStream', provenance: 'network' },
+  { kind: 'source', id: 'cs-registry-getvalue',    language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'GetValue', receiver: '[Rr]egistry' }, label: 'Registry(Key).GetValue', provenance: 'env' },
+  // `receiverTypeIn` (SARD_80_F1 W4.C39): additive to the `receiver` name
+  // regex, never a replacement — confirms a match via CHA-resolved declared
+  // type when Juliet's own idiomatic short variable name (`dr`) fails the
+  // name check outright (no "reader" substring). Same
+  // DATAREADER_SOURCE_TYPES list already established for the SEPARATE
+  // lexical structural tracker at posture/csharp-analysis.js (W4.C34).
+  { kind: 'source', id: 'cs-datareader-getstring', language: 'cs', framework: 'ado',    match: { type: 'call', callee: 'GetString', receiver: '[Rr]eader', receiverTypeIn: ['^(?:Sql|OleDb|Odbc|MySql|Npgsql|Sqlite)DataReader$'] }, label: 'SqlDataReader.GetString' },
+  { kind: 'source', id: 'cs-datareader-getvalue',  language: 'cs', framework: 'ado',    match: { type: 'call', callee: 'GetValue',  receiver: '[Rr]eader', receiverTypeIn: ['^(?:Sql|OleDb|Odbc|MySql|Npgsql|Sqlite)DataReader$'] }, label: 'SqlDataReader.GetValue' },
+  { kind: 'source', id: 'cs-datareader-getint32',  language: 'cs', framework: 'ado',    match: { type: 'call', callee: 'GetInt32',  receiver: '[Rr]eader', receiverTypeIn: ['^(?:Sql|OleDb|Odbc|MySql|Npgsql|Sqlite)DataReader$'] }, label: 'SqlDataReader.GetInt32' },
+  // File-read variants: the CONTENTS of a file are untrusted data (a
+  // taint SOURCE) independent of whether the PATH argument to the same
+  // call is itself tainted (`cs-file-readall` below still checks that,
+  // on the same call, for the path-traversal family — a call can be both
+  // a source and a sink argument at once, same as every other language's
+  // `open(path).read()` shape in this catalog).
+  { kind: 'source', id: 'cs-file-readalltext-src', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'ReadAllText',  receiver: '^File$' }, label: 'File.ReadAllText',  provenance: 'file-read' },
+  { kind: 'source', id: 'cs-file-readalllines-src', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'ReadAllLines', receiver: '^File$' }, label: 'File.ReadAllLines', provenance: 'file-read' },
 
   // ─── SINKS (C#) ──────────────────────────────────────────────────────────
   { kind: 'sink', id: 'cs-sqlcommand',         language: 'cs', framework: 'ado',    match: { type: 'call', callee: 'SqlCommand' },     argIndex: 0,
@@ -1248,6 +1542,33 @@ export const CATALOG = [
     match: { type: 'call', callee: 'Start', requireLiteralArg: { index: 0, pattern: '^"cmd(?:\\.exe)?"$|^"(?:/bin/)?(?:sh|bash)"$' } }, argIndex: 'all',
     vuln: { name: 'Command Injection (Process.Start string-form)', severity: 'critical', cwe: 'CWE-78',
             remediation: 'Use ProcessStartInfo with separated FileName + Arguments; never pass /c with concat.' } },
+  // The SINGLE-argument `Process.Start(commandString)` overload — Juliet's
+  // OWN canonical C# CWE-78 shape (confirmed by reading the real, public
+  // Juliet C# mirror this project's own SARD manifest pins:
+  // `github.com/snyk-schmidtty/juliet-test-suite-csharp`,
+  // `CWE78_OS_Command_Injection__Connect_tcp_01.cs`:
+  // `Process.Start(osCommand + data)`, the interpreter-plus-arguments
+  // ALREADY concatenated into ONE tainted string before the call).
+  // Neither entry above can ever match this: `cs-process-start`'s
+  // `requireLiteralArg` fails CLOSED because arg0 here is a CONCAT
+  // expression, not a literal (there is no separate, provably-shell
+  // literal to check — the whole point of this shape); `cs-process-
+  // start-args` checks argIndex 1, which does not exist on a one-argument
+  // call. Unlike the 2-argument array-execve form (filename, args[]),
+  // there is no safe interpretation of this overload with a tainted
+  // argument — the ENTIRE string IS the thing .NET treats as a shell-
+  // dispatchable command line — so no `requireLiteralArg` gate applies
+  // here at all. Scoped to the `Process` receiver (a real BCL class name,
+  // not scrambled by --scramble-identifiers) to avoid over-matching an
+  // unrelated `.Start()` call (a `Timer`/`Thread`/`Stopwatch`, none of
+  // which take a string command argument at all, but bare `callee:
+  // 'Start'` with no receiver constraint — as the two entries above
+  // already do — would still be a real precision risk for a hypothetical
+  // future scrambled receiver).
+  { kind: 'sink', id: 'cs-process-start-single', language: 'cs', framework: 'stdlib',
+    match: { type: 'call', callee: 'Start', receiver: '^Process$' }, argIndex: 0,
+    vuln: { name: 'Command Injection (Process.Start single-argument command string)', severity: 'critical', cwe: 'CWE-78',
+            remediation: 'Use ProcessStartInfo with separated FileName + ArgumentList; never build one concatenated command-line string.' } },
   // Companion to the entry above, for the NON-shell-literal filename case
   // that entry deliberately excludes (`Process.Start("ping", tainted)`).
   // This is a real, distinct risk, not a benchmark-only shape:
@@ -1296,10 +1617,75 @@ export const CATALOG = [
   { kind: 'sink', id: 'cs-localredirect',      language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'LocalRedirect' },   argIndex: 0,
     vuln: { name: 'Open Redirect (Controller.LocalRedirect)', severity: 'medium', cwe: 'CWE-601',
             remediation: 'LocalRedirect rejects absolute URLs, but a crafted relative path can still redirect off-site via scheme-relative (//evil.com) input — validate the path.' } },
-  { kind: 'sink', id: 'cs-response-write',     language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'Write', receiver: '^Response$' }, argIndex: 0,
+  // SARD 80% F1 push — this project's own W4.C1 investigation logged
+  // C# CWE-80/81/83 as a "total blackout... zero findings of ANY kind
+  // across 1084 real files", assumed to need deep architectural work.
+  // Root cause, confirmed via the public Juliet C# mirror this project's
+  // manifest pins (`CWE80_XSS__CWE182_Web_Connect_tcp_01.cs`): the sink is
+  // `resp.Write(...)`, where `resp` is a METHOD PARAMETER
+  // (`Bad(HttpRequest req, HttpResponse resp)`) — never the literal
+  // identifier `Response` this entry's `receiver: '^Response$'` required,
+  // exact-match, with no alternation at all. `receiver` widened to accept
+  // the overwhelmingly common real-world parameter names
+  // (`resp`/`response`, either casing) and `receiverTypeIn` added as an
+  // ADDITIVE fallback (same pattern as `cs-htmltextwriter-write` below —
+  // `receiver` stays required, since `_receiverAllowed` matches ANY
+  // receiver when neither `receiver` nor `receiverBase` is set), seeded
+  // from `resp`'s declared parameter type (`fn.paramTypes`, confirmed via
+  // direct IR dump to already capture `resp: "HttpResponse"` with no
+  // parser changes needed).
+  { kind: 'sink', id: 'cs-response-write',     language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'Write', receiver: '[Rr]esp(?:onse)?', receiverTypeIn: ['^HttpResponse$'] }, argIndex: 0,
     vuln: { name: 'Reflected XSS (Response.Write)', severity: 'high', cwe: 'CWE-79',
             remediation: 'HTML-encode with HttpUtility.HtmlEncode before writing user input to the response.' } },
-  { kind: 'sink', id: 'cs-response-addheader', language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'AddHeader', receiver: '^Response$' }, argIndex: 1,
+  // CWE-81 (XSS in Error Message) — a member-WRITE sink, not a call at
+  // all: Juliet's real C# shape (confirmed via the public Juliet mirror
+  // this project's manifest pins,
+  // CWE81_XSS_Error_Message__Web_Connect_tcp_01.cs) sets
+  // `resp.StatusDescription = "..." + data;` directly. This was a
+  // genuinely MISSING sink (no catalog entry of any kind referenced
+  // `StatusDescription`), not a receiver-name mismatch like
+  // `cs-response-write`'s bug above — the two gaps happened to share a
+  // CWE-80/81/83 investigation but have different root causes.
+  // `match.object: '_any_'` required for any member-WRITE sink (see
+  // dataflow/CLAUDE.md's gotcha); same receiver/receiverTypeIn shape as
+  // `cs-response-write` for consistency and scramble-safety.
+  { kind: 'sink', id: 'cs-response-statusdescription', language: 'cs', framework: 'aspnet', match: { type: 'member', object: '_any_', prop: 'StatusDescription', receiver: '[Rr]esp(?:onse)?', receiverTypeIn: ['^HttpResponse$'] }, argIndex: 'rhs',
+    vuln: { name: 'Reflected XSS (Response.StatusDescription assigned a tainted value)', severity: 'high', cwe: 'CWE-81',
+            remediation: 'HTML-encode with HttpUtility.HtmlEncode before assigning user input to StatusDescription, or avoid echoing it in a custom error page.' } },
+  // SARD_80_F1 W4: `HtmlTextWriter` (ASP.NET Web Forms' `Render(HtmlTextWriter
+  // writer)` override, and its declared-local-variable form
+  // `HtmlTextWriter writer = ...; writer.Write(x);`) is a named W4 target
+  // (495 dev cases) with NO prior catalog coverage at all — only the
+  // structural `csharp.js` detector's name-based heuristic
+  // (`/Writer|writer|output/i.test(call.receiver)`) could ever catch it,
+  // and only when the variable happens to be named with "writer"/"output"
+  // in it. `receiverTypeIn` (additive, never replaces a name check) lets
+  // this ALSO fire off `class-hierarchy.js`'s `typeOfVar`, populated from
+  // either a declared-type local (`parser-cs.js`'s `declaredType`) or a
+  // parameter's declared type — same mechanism proven for Java's
+  // `PrintWriter` two-step gap (see `java-writer-*` above).
+  //
+  // `receiver` is still REQUIRED here, not optional: `_receiverAllowed`
+  // (catalog.js) returns `true` UNCONDITIONALLY when an entry sets neither
+  // `receiver` nor `receiverBase` — so a `receiverTypeIn`-only entry would
+  // match `Write`/`WriteLine` on ANY receiver whatsoever (Console, a
+  // StreamWriter, a logger, literally anything), not narrow the match at
+  // all. Caught before shipping by re-reading `_receiverAllowed`'s own
+  // short-circuit, not by a failing test — `Write`/`WriteLine` are far too
+  // generic a method name for `receiverTypeIn` to safely stand alone the
+  // way the single-purpose `getString`/`fromString`-style entries
+  // elsewhere in this file do. The name pattern mirrors the pre-existing
+  // structural detector's own convention (`csharp.js`'s
+  // `/Writer|writer|output/i`) so the two stay aligned.
+  { kind: 'sink', id: 'cs-htmltextwriter-write',     language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'Write', receiver: '(?:[Ww]riter|output)', receiverTypeIn: ['^HtmlTextWriter$'] }, argIndex: 0,
+    vuln: { name: 'Reflected XSS (HtmlTextWriter.Write)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'HTML-encode with HttpUtility.HtmlEncode before writing user input to an HtmlTextWriter.' } },
+  { kind: 'sink', id: 'cs-htmltextwriter-writeline', language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'WriteLine', receiver: '(?:[Ww]riter|output)', receiverTypeIn: ['^HtmlTextWriter$'] }, argIndex: 0,
+    vuln: { name: 'Reflected XSS (HtmlTextWriter.WriteLine)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'HTML-encode with HttpUtility.HtmlEncode before writing user input to an HtmlTextWriter.' } },
+  // Same `resp` (parameter name, not the literal identifier `Response`)
+  // root cause as `cs-response-write` above.
+  { kind: 'sink', id: 'cs-response-addheader', language: 'cs', framework: 'aspnet', match: { type: 'call', callee: 'AddHeader', receiver: '[Rr]esp(?:onse)?', receiverTypeIn: ['^HttpResponse$'] }, argIndex: 1,
     vuln: { name: 'HTTP Response Splitting / Header Injection (Response.AddHeader)', severity: 'high', cwe: 'CWE-113',
             remediation: 'Strip CR/LF from header values, or use a framework API that rejects them automatically.' } },
   { kind: 'sink', id: 'cs-xmldoc-load',        language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Load', receiver: '^(?:[Xx]ml[Dd]oc(?:ument)?|xmlDoc|doc)$' }, argIndex: 0,
@@ -1333,12 +1719,135 @@ export const CATALOG = [
     vuln: { name: 'LDAP Injection (DirectorySearcher.Filter assigned a concatenated value)', severity: 'high', cwe: 'CWE-90',
             remediation: 'Escape LDAP special characters in filter components, or build the filter with a parameterized helper.' } },
 
+  // `CommandText = tainted` — Juliet's dominant real-world SQLi shape,
+  // even more common than the `new SqlCommand(tainted, conn)` constructor
+  // form `cs-sqlcommand` already covers: build the command with a fixed
+  // (often parameterless) constructor, then assign the query text to the
+  // property afterward. `match.object: '_any_'` is required for any
+  // member-WRITE sink (see dataflow/CLAUDE.md's gotcha on this) — object
+  // specificity is applied afterward via `receiverTypeIn`.
+  { kind: 'sink', id: 'cs-commandtext-write', language: 'cs', framework: 'ado', match: { type: 'member', object: '_any_', prop: 'CommandText', receiverTypeIn: ['^(?:Sql|OleDb|Odbc|MySql|Npgsql|Sqlite)Command$'] }, argIndex: 'rhs',
+    vuln: { name: 'SQL Injection (CommandText assigned a concatenated/tainted value)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use a parameterized query: keep `CommandText` a fixed string with `@name` placeholders and bind values via `cmd.Parameters.AddWithValue(...)`.' } },
+  // Juliet's canonical C# CWE-78 shape: build a `Process` object with a
+  // parameterless/fixed constructor, then assign the tainted command text
+  // to `.StartInfo.Arguments` (or, less commonly, `.StartInfo.FileName`)
+  // afterward — the exact same "construct-then-assign" idiom
+  // `cs-commandtext-write` above already models for SQL, just never
+  // ported to this sink. Found via direct probing (a synthetic
+  // `Process.Start()`-based Juliet-shaped fixture produced ZERO findings
+  // of ANY kind before this entry existed), not assumed: the two PRE-
+  // EXISTING C# CWE-78 entries (`cs-process-start`/`cs-process-start-args`)
+  // both key off the static `Process.Start(...)` CALL form, which this
+  // idiom never uses at all — `.Start()` is called on the instance with NO
+  // arguments, so neither entry's `argIndex` had anything to check.
+  // `match.object: '_any_'` required for any member-WRITE sink (see
+  // dataflow/CLAUDE.md's gotcha); scoped via a name-based `receiver`
+  // rather than `receiverTypeIn` since `ProcessStartInfo`'s own property
+  // name (`StartInfo`) is a reliable, idiomatic .NET naming convention on
+  // its own, and seeding `typeOfVar` for `new Process()` var was not yet
+  // verified to work for this shape.
+  { kind: 'sink', id: 'cs-processstartinfo-arguments', language: 'cs', framework: 'stdlib', match: { type: 'member', object: '_any_', prop: 'Arguments', receiver: 'StartInfo' }, argIndex: 'rhs',
+    vuln: { name: 'Command Injection (ProcessStartInfo.Arguments assigned a concatenated/tainted value)', severity: 'critical', cwe: 'CWE-78',
+            remediation: 'Use ProcessStartInfo.ArgumentList (never a single concatenated Arguments string), or validate/allow-list the argument content.' } },
+  { kind: 'sink', id: 'cs-processstartinfo-filename', language: 'cs', framework: 'stdlib', match: { type: 'member', object: '_any_', prop: 'FileName', receiver: 'StartInfo' }, argIndex: 'rhs',
+    vuln: { name: 'Command Injection (ProcessStartInfo.FileName assigned a tainted value)', severity: 'critical', cwe: 'CWE-78',
+            remediation: 'Resolve the executable path against an explicit allow-list before assigning it to ProcessStartInfo.FileName.' } },
+  { kind: 'sink', id: 'cs-sqldataadapter', language: 'cs', framework: 'ado', match: { type: 'call', callee: 'SqlDataAdapter' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (new SqlDataAdapter with concatenated query text)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Pass a parameterized SqlCommand to the adapter instead of a raw query string.' } },
+  { kind: 'sink', id: 'cs-oledbcommand', language: 'cs', framework: 'ado', match: { type: 'call', callee: 'OleDbCommand' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (new OleDbCommand with concatenated query text)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use parameterized OleDbCommand: bind values via `cmd.Parameters.AddWithValue(...)` rather than concatenating into the command text.' } },
+  { kind: 'sink', id: 'cs-odbccommand', language: 'cs', framework: 'ado', match: { type: 'call', callee: 'OdbcCommand' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (new OdbcCommand with concatenated query text)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use parameterized OdbcCommand: bind values via `cmd.Parameters.AddWithValue(...)` rather than concatenating into the command text.' } },
+  // Reflection-based dynamic type loading (CWE-470, "Unsafe Reflection") —
+  // resolving/instantiating a type by a tainted name lets the caller pick
+  // ANY loadable type, which is exactly what CWE-502-adjacent deserializer
+  // gadget chains need.
+  { kind: 'sink', id: 'cs-type-gettype', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'GetType', receiver: '^Type$' }, argIndex: 0,
+    vuln: { name: 'Unsafe Reflection (Type.GetType with tainted type name)', severity: 'high', cwe: 'CWE-470',
+            remediation: 'Resolve against an explicit allow-list of known-safe type names before calling Type.GetType/Activator.CreateInstance.' } },
+  { kind: 'sink', id: 'cs-assembly-load', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Load', receiver: '^Assembly$' }, argIndex: 0,
+    vuln: { name: 'Unsafe Reflection (Assembly.Load with tainted assembly name)', severity: 'high', cwe: 'CWE-470',
+            remediation: 'Never load an assembly by a user-controlled name or path; resolve against an explicit allow-list.' } },
+  { kind: 'sink', id: 'cs-activator-createinstance', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'CreateInstance', receiver: '^Activator$' }, argIndex: 'all',
+    vuln: { name: 'Unsafe Reflection (Activator.CreateInstance with a tainted type)', severity: 'high', cwe: 'CWE-470',
+            remediation: 'Resolve the target type against an explicit allow-list before instantiating it dynamically.' } },
+  // CWE-134 — an attacker-controlled FORMAT string (not just an
+  // interpolated argument) can inject its own `{n}`/`%` directives.
+  // Scoped to arg0 ONLY, deliberately: `String.Format`'s substitution
+  // arguments (index 1+) are DATA, not format directives, so a tainted
+  // substitution argument reaching an otherwise-literal format string
+  // (`String.Format("Hello, {0}!", name)`) is not this vulnerability —
+  // only the FORMAT STRING itself being attacker-controlled is. A bare
+  // `Console.WriteLine(tainted)` single-argument sink was deliberately
+  // NOT added alongside this: with only one argument there is no `{n}`
+  // substitution happening at all (that overload does not treat its sole
+  // argument as a format string), so it would have no real CWE-134
+  // shape to detect — confirmed by a nested-call precision fixture where
+  // such a sink fired on a value that was already-formatted output text
+  // wrapping a merely-tainted substitution argument.
+  // `^[Ss]tring$`, not `^String$`: C#'s `string` keyword is a real,
+  // interchangeable alias for `System.String` (`string.Format(...)` and
+  // `String.Format(...)` compile to the IDENTICAL call), and Juliet's own
+  // real C# CWE-134 corpus (confirmed via the public Juliet mirror this
+  // project's SARD manifest pins) uses the lowercase form exclusively
+  // (`Console.Write(string.Format(data))`) — the capitalized-only pattern
+  // silently missed 100% of this corpus's own CWE-134 cases, confirmed by
+  // a direct probe (`String.Format` fires via IR-TAINT; the byte-identical
+  // `string.Format` produces zero IR-TAINT findings before this fix).
+  { kind: 'sink', id: 'cs-string-format', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Format', receiver: '^[Ss]tring$' }, argIndex: 0,
+    vuln: { name: 'Externally-Controlled Format String (String.Format)', severity: 'medium', cwe: 'CWE-134',
+            remediation: 'Never build the FORMAT string itself from user input; keep the format literal and pass user data only as substitution arguments.' } },
+  // CWE-643 — XPath built from concatenated/tainted text.
+  //
+  // `receiverTypeIn` added: Juliet's OWN canonical C# CWE-643 shape
+  // (confirmed via the public Juliet C# mirror this project's SARD
+  // manifest pins, `CWE643_Xpath_Injection__Connect_tcp_01.cs`) names its
+  // `XPathNavigator` variable `xPath` — matching neither `[Nn]av` nor
+  // `[Nn]avigator`. Worse than a one-off naming miss: under
+  // `--scramble-identifiers` (the ONLY mode this benchmark ever scores
+  // from), EVERY local variable name becomes an opaque hash regardless of
+  // what it was originally called, so a receiver match keyed purely on
+  // NAME can never fire on this benchmark at all, independent of Juliet's
+  // own naming choice. `receiverTypeIn` is additive (OR'd with the name
+  // check, never replacing it — see `_receiverTypeConfirms`), seeded here
+  // from the declared-type annotation on `XPathNavigator xPath =
+  // inputXml.CreateNavigator();` (parser-cs.js's `declaredType` capture on
+  // assign nodes, landed earlier this session for an unrelated task,
+  // needed no changes to support this).
+  { kind: 'sink', id: 'cs-xpathnavigator-select', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Select', receiver: '[Nn]av(?:igator)?', receiverTypeIn: ['^XPathNavigator$'] }, argIndex: 0,
+    vuln: { name: 'XPath Injection (XPathNavigator.Select with concatenated expression)', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Use XPath variables (`XsltArgumentList`/`XPathExpression.SetContext`) instead of concatenating user input into the expression text.' } },
+  { kind: 'sink', id: 'cs-xpathnavigator-evaluate', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'Evaluate', receiver: '[Nn]av(?:igator)?', receiverTypeIn: ['^XPathNavigator$'] }, argIndex: 0,
+    vuln: { name: 'XPath Injection (XPathNavigator.Evaluate with concatenated expression)', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Use XPath variables instead of concatenating user input into the expression text.' } },
+  { kind: 'sink', id: 'cs-selectsinglenode', language: 'cs', framework: 'stdlib', match: { type: 'call', callee: 'SelectSingleNode' }, argIndex: 0,
+    vuln: { name: 'XPath Injection (XmlNode.SelectSingleNode with concatenated expression)', severity: 'high', cwe: 'CWE-643',
+            remediation: 'Use XPath variables instead of concatenating user input into the expression text.' } },
   // ─── SANITIZERS (C#) ─────────────────────────────────────────────────────
   { kind: 'sanitizer', id: 'cs-html-encode',    language: 'cs', match: { type: 'call', callee: 'HtmlEncode' },     effect: 'strip', appliesTo: ['xss'] },
   { kind: 'sanitizer', id: 'cs-url-encode',     language: 'cs', match: { type: 'call', callee: 'UrlEncode' },      effect: 'strip', appliesTo: ['url'] },
   { kind: 'sanitizer', id: 'cs-path-getfullpath',language: 'cs', match: { type: 'call', callee: 'GetFullPath' },   effect: 'taintIf-not-pinned', appliesTo: ['path'] },
-  { kind: 'sanitizer', id: 'cs-int-parse',      language: 'cs', match: { type: 'call', callee: 'Parse' },          effect: 'strip', appliesTo: ['*'] },
-  { kind: 'sanitizer', id: 'cs-int-tryparse',   language: 'cs', match: { type: 'call', callee: 'TryParse' },       effect: 'strip', appliesTo: ['*'] },
+  // Receiver-scoped to numeric types (SARD_80_F1_SCANNER_PRD.md): `Parse` and
+  // `TryParse` are extremely common bare method names across .NET — `XDocument
+  // .Parse`, `JObject.Parse`, `DateTime.Parse`, `Uri`-adjacent parsers, and any
+  // custom type's own `Parse` all share the name, and NONE of them coerce to a
+  // non-string-injectable value the way a numeric parse does (a parsed XML/JSON
+  // document's text content round-trips the original characters right back out
+  // through `.ToString()`). Unscoped, this entry was already a precision bug
+  // under the old demote-only semantics; it becomes an active false-negative
+  // risk now that a universal tag can KILL taint outright (engine.js's
+  // _isCoercionCall) — `var doc = XDocument.Parse(tainted); sink(doc.Value);`
+  // would otherwise be reported clean.
+  { kind: 'sanitizer', id: 'cs-int-parse',      language: 'cs',
+    match: { type: 'call', callee: 'Parse', receiver: '^[Uu]?(?:[Ii]nt(?:32|64|16)?|[Ll]ong|[Dd]ouble|[Ff]loat|[Dd]ecimal|[Ss]hort|[Bb]yte|SByte)$' },
+    effect: 'strip', appliesTo: ['*'] },
+  { kind: 'sanitizer', id: 'cs-int-tryparse',   language: 'cs',
+    match: { type: 'call', callee: 'TryParse', receiver: '^[Uu]?(?:[Ii]nt(?:32|64|16)?|[Ll]ong|[Dd]ouble|[Ff]loat|[Dd]ecimal|[Ss]hort|[Bb]yte|SByte)$' },
+    effect: 'strip', appliesTo: ['*'] },
   { kind: 'sanitizer', id: 'cs-regex-escape',   language: 'cs', match: { type: 'call', callee: 'Escape' },         effect: 'strip', appliesTo: ['regex'] },
   { kind: 'sanitizer', id: 'cs-addwithvalue',   language: 'cs', match: { type: 'call', callee: 'AddWithValue' },   effect: 'strip', appliesTo: ['sql'] },
 
@@ -1353,7 +1862,25 @@ export const CATALOG = [
   { kind: 'sink', id: 'kt-jdbc-execute',       language: 'kt', framework: 'jdbc',   match: { type: 'call', callee: 'executeQuery' }, argIndex: 0,
     vuln: { name: 'SQL Injection (JDBC executeQuery from Kotlin)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use PreparedStatement + setX(N, v) — Kotlin string templates concatenated into SQL are still injection.' } },
-  { kind: 'sink', id: 'kt-exposed-exec',       language: 'kt', framework: 'exposed', match: { type: 'call', callee: 'exec' },        argIndex: 0,
+  // SARD_80_F1 W4.J26: `kt-exposed-exec` and `kt-runtime-exec` (below) both
+  // key on the SAME bare callee name `exec` with argIndex 0 — the only real
+  // JVM-runtime overload of that name being ambiguous between Exposed's SQL
+  // `.exec(sql)` and `Runtime.exec(cmd)`. Since `java`/`kt` share one
+  // catalog-scoping family (see `_LANG_FAMILY` above), this ALSO matched
+  // Java's own `Runtime.getRuntime().exec(cmd)` idiom — confirmed on real
+  // corpus data (`sard-juliet-java-strict`'s CWE-78 command-injection test
+  // files): 251 dev-split false positives, ALL misreported as
+  // "SQL Injection (Exposed.exec)" on a plain OS-command-execution call,
+  // with the correct `kt-runtime-exec`/CWE-78 finding never surviving
+  // `dedupeFindingsWithEvidence`'s same-severity tie-break (first-inserted
+  // wins). `receiverExclude` (see below) is the ONLY negative-match form
+  // this catalog supports (`py-compile`'s own precedent) — excludes any
+  // call whose receiver chain contains `Runtime`, `getRuntime`, or
+  // `ProcessBuilder` (Java's `Runtime`/`ProcessBuilder` classes are always
+  // capitalized; a bare, receiver-less `exec(sql)` — Exposed's more common
+  // shape — is untouched, since `receiverExclude` can never match a call
+  // with no receiver segments at all).
+  { kind: 'sink', id: 'kt-exposed-exec',       language: 'kt', framework: 'exposed', match: { type: 'call', callee: 'exec', receiverExclude: 'Runtime|ProcessBuilder' },        argIndex: 0,
     vuln: { name: 'SQL Injection (Exposed.exec with raw string)', severity: 'critical', cwe: 'CWE-89',
             remediation: 'Use Exposed DSL queries or named-parameter exec with a typed parameter list.' } },
   { kind: 'sink', id: 'kt-runtime-exec',       language: 'kt', framework: 'stdlib', match: { type: 'call', callee: 'exec' },         argIndex: 0,
@@ -1393,6 +1920,16 @@ export const CATALOG = [
   { kind: 'source', id: 'cpp-read',    language: 'cpp', framework: null, match: { type: 'call', callee: 'read'    }, label: 'read()',    provenance: 'file-read' },
   { kind: 'source', id: 'cpp-fread',   language: 'cpp', framework: null, match: { type: 'call', callee: 'fread'   }, label: 'fread()',   provenance: 'file-read' },
   { kind: 'source', id: 'cpp-fgets',   language: 'cpp', framework: null, match: { type: 'call', callee: 'fgets'   }, label: 'fgets()',   provenance: 'file-read' },
+  // SARD PHP corpus: fgets()/fread() are receiver-agnostic in this
+  // language too (`fgets($fh)` reads from stdin/a socket/a file alike).
+  // Declared AFTER the cpp entries above on purpose: `matchSource`'s
+  // no-file-context callers (test/cpp-integration.test.js's own
+  // "non-colliding" assertion) tiebreak same-named cross-language entries by
+  // declaration order when `_languageAllowed` has no file extension to
+  // filter on; a real scan always has a file path, so `_languageAllowed`
+  // picks the right language regardless of this order.
+  { kind: 'source', id: 'php-fgets', language: 'php', framework: 'core', match: { type: 'call', callee: 'fgets' }, label: 'fgets()', provenance: 'file-read' },
+  { kind: 'source', id: 'php-fread', language: 'php', framework: 'core', match: { type: 'call', callee: 'fread' }, label: 'fread()', provenance: 'file-read' },
   { kind: 'source', id: 'cpp-gets',    language: 'cpp', framework: null, match: { type: 'call', callee: 'gets'    }, label: 'gets()',    provenance: 'stdin' },
   { kind: 'source', id: 'cpp-scanf',   language: 'cpp', framework: null, match: { type: 'call', callee: 'scanf'   }, label: 'scanf()',   provenance: 'stdin' },
 
@@ -1426,6 +1963,210 @@ export const CATALOG = [
   // inert, but a future sanitizer consumer would silently turn this into a
   // false negative. realpath() stays: it genuinely canonicalises a path,
   // which is the property CWE-22 sinks care about.
+
+  // ─── SOURCES (Rust) ───────────────────────────────────────────────────────
+  // Rust's web frameworks (axum, actix-web, rocket, warp) deliver request data
+  // through EXTRACTOR-TYPED parameters (`Query(q): Query<P>`, `q: web::Query<P>`),
+  // not through calls on a request object, so the dominant source shape is the
+  // annotation channel: `parser-rust.js` emits a `paramAnnotations` entry whose
+  // `decorator` is the extractor's type name (or `RouteParam` for every plain
+  // parameter of a `#[get("/…/<x>")]`-attributed rocket handler). A closure
+  // handler's extractor param is lowered to a synthetic `__rs_extract__.<Type>`
+  // call instead, matched by the receiver-scoped call sources below.
+  { kind: 'source', id: 'rs-extract-query',      language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Query' },       label: 'Query<T> extractor (axum/actix)', provenance: 'url-param' },
+  { kind: 'source', id: 'rs-extract-path',       language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Path' },        label: 'Path<T> extractor (axum/actix)',  provenance: 'path-param' },
+  { kind: 'source', id: 'rs-extract-json',       language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Json' },        label: 'Json<T> extractor (axum/actix/rocket)', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-extract-form',       language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Form' },        label: 'Form<T> extractor (axum/actix/rocket)', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-extract-headermap',  language: 'rs', framework: 'web', match: { type: 'annotation', name: 'HeaderMap' },   label: 'HeaderMap extractor (axum)', provenance: 'header' },
+  { kind: 'source', id: 'rs-extract-typedheader',language: 'rs', framework: 'web', match: { type: 'annotation', name: 'TypedHeader' }, label: 'TypedHeader<T> extractor (axum)', provenance: 'header' },
+  { kind: 'source', id: 'rs-extract-rawquery',   language: 'rs', framework: 'web', match: { type: 'annotation', name: 'RawQuery' },    label: 'RawQuery extractor (axum)', provenance: 'url-param' },
+  { kind: 'source', id: 'rs-extract-rawform',    language: 'rs', framework: 'web', match: { type: 'annotation', name: 'RawForm' },     label: 'RawForm extractor (axum)', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-extract-multipart',  language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Multipart' },   label: 'Multipart extractor (axum/actix)', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-extract-multipartform', language: 'rs', framework: 'web', match: { type: 'annotation', name: 'MultipartForm' }, label: 'MultipartForm extractor (actix)', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-extract-httprequest',language: 'rs', framework: 'web', match: { type: 'annotation', name: 'HttpRequest' }, label: 'HttpRequest (actix)' },
+  { kind: 'source', id: 'rs-extract-request',    language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Request' },     label: 'Request<Body> (axum/hyper)' },
+  { kind: 'source', id: 'rs-extract-cookiejar',  language: 'rs', framework: 'web', match: { type: 'annotation', name: 'CookieJar' },   label: 'CookieJar extractor', provenance: 'cookie' },
+  { kind: 'source', id: 'rs-extract-cookies',    language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Cookies' },     label: 'Cookies extractor', provenance: 'cookie' },
+  { kind: 'source', id: 'rs-extract-host',       language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Host' },        label: 'Host extractor (axum)', provenance: 'header' },
+  { kind: 'source', id: 'rs-extract-originaluri',language: 'rs', framework: 'web', match: { type: 'annotation', name: 'OriginalUri' }, label: 'OriginalUri extractor (axum)', provenance: 'url-param' },
+  { kind: 'source', id: 'rs-extract-rawpathparams', language: 'rs', framework: 'web', match: { type: 'annotation', name: 'RawPathParams' }, label: 'RawPathParams extractor (axum)', provenance: 'path-param' },
+  { kind: 'source', id: 'rs-extract-bytes',      language: 'rs', framework: 'web', match: { type: 'annotation', name: 'Bytes' },       label: 'Bytes body extractor (axum)', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-route-param',        language: 'rs', framework: 'rocket', match: { type: 'annotation', name: 'RouteParam' }, label: 'route parameter of a #[get("/<x>")] handler (rocket)', provenance: 'path-param' },
+  // Closure-handler extractors (`web::get().to(|q: web::Query<P>| async move { … })`).
+  { kind: 'source', id: 'rs-closure-extract-query',   language: 'rs', framework: 'web', match: { type: 'call', callee: 'Query',       receiver: '^__rs_extract__$' }, label: 'Query<T> closure extractor', provenance: 'url-param' },
+  { kind: 'source', id: 'rs-closure-extract-path',    language: 'rs', framework: 'web', match: { type: 'call', callee: 'Path',        receiver: '^__rs_extract__$' }, label: 'Path<T> closure extractor', provenance: 'path-param' },
+  { kind: 'source', id: 'rs-closure-extract-json',    language: 'rs', framework: 'web', match: { type: 'call', callee: 'Json',        receiver: '^__rs_extract__$' }, label: 'Json<T> closure extractor', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-closure-extract-form',    language: 'rs', framework: 'web', match: { type: 'call', callee: 'Form',        receiver: '^__rs_extract__$' }, label: 'Form<T> closure extractor', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-closure-extract-headers', language: 'rs', framework: 'web', match: { type: 'call', callee: 'HeaderMap',   receiver: '^__rs_extract__$' }, label: 'HeaderMap closure extractor', provenance: 'header' },
+  { kind: 'source', id: 'rs-closure-extract-request', language: 'rs', framework: 'web', match: { type: 'call', callee: 'HttpRequest', receiver: '^__rs_extract__$' }, label: 'HttpRequest closure extractor' },
+  // Request-object accessors (actix `HttpRequest`, hyper/axum `Request`).
+  { kind: 'source', id: 'rs-req-query-string', language: 'rs', framework: 'actix', match: { type: 'call', callee: 'query_string' }, label: 'req.query_string() (actix)', provenance: 'url-param' },
+  { kind: 'source', id: 'rs-req-match-info',   language: 'rs', framework: 'actix', match: { type: 'call', callee: 'match_info' },   label: 'req.match_info() (actix)', provenance: 'path-param' },
+  { kind: 'source', id: 'rs-req-cookie',       language: 'rs', framework: 'actix', match: { type: 'call', callee: 'cookie', receiver: '^(?:req|request|jar|cookies)$' }, label: 'req.cookie() (actix)', provenance: 'cookie' },
+  { kind: 'source', id: 'rs-req-headers',      language: 'rs', framework: 'web',   match: { type: 'call', callee: 'headers', receiver: '^(?:req|request|parts)$' }, label: 'req.headers()', provenance: 'header' },
+  { kind: 'source', id: 'rs-req-uri-query',    language: 'rs', framework: 'hyper', match: { type: 'call', callee: 'query', receiver: '^uri$' }, label: 'req.uri().query() (hyper/axum)', provenance: 'url-param' },
+  // warp composes filters; the extracted value arrives as a closure parameter
+  // bound (by parser-rust.js) to the receiver chain, so `warp.query`-style
+  // MEMBER sources cover `warp::query().map(|q| …)` and the CALL forms cover
+  // `let q = warp::query::<P>();`.
+  { kind: 'source', id: 'rs-warp-query-member',  language: 'rs', framework: 'warp', match: { type: 'member', object: 'warp', prop: 'query' },  label: 'warp::query() (warp)', provenance: 'url-param' },
+  { kind: 'source', id: 'rs-warp-body-member',   language: 'rs', framework: 'warp', match: { type: 'member', object: 'warp', prop: 'body' },   label: 'warp::body::* (warp)', provenance: 'http-body' },
+  { kind: 'source', id: 'rs-warp-header-member', language: 'rs', framework: 'warp', match: { type: 'member', object: 'warp', prop: 'header' }, label: 'warp::header() (warp)', provenance: 'header' },
+  { kind: 'source', id: 'rs-warp-path-member',   language: 'rs', framework: 'warp', match: { type: 'member', object: 'warp', prop: 'path' },   label: 'warp::path::param() (warp)', provenance: 'path-param' },
+  { kind: 'source', id: 'rs-warp-query',   language: 'rs', framework: 'warp', match: { type: 'call', callee: 'query', receiver: '^warp$' },  label: 'warp::query() (warp)', provenance: 'url-param' },
+  { kind: 'source', id: 'rs-warp-param',   language: 'rs', framework: 'warp', match: { type: 'call', callee: 'param', receiver: '^(?:warp|path)$' }, label: 'warp::path::param() (warp)', provenance: 'path-param' },
+  { kind: 'source', id: 'rs-warp-header',  language: 'rs', framework: 'warp', match: { type: 'call', callee: 'header', receiver: '^warp$' }, label: 'warp::header() (warp)', provenance: 'header' },
+  // Process environment and CLI arguments: untrusted in the same sense the
+  // other languages' `getenv`/`argv` entries are.
+  { kind: 'source', id: 'rs-env-var',    language: 'rs', framework: 'std', match: { type: 'call', callee: 'var',     receiver: '^env$' }, label: 'std::env::var()', provenance: 'env' },
+  { kind: 'source', id: 'rs-env-var-os', language: 'rs', framework: 'std', match: { type: 'call', callee: 'var_os',  receiver: '^env$' }, label: 'std::env::var_os()', provenance: 'env' },
+  { kind: 'source', id: 'rs-env-args',   language: 'rs', framework: 'std', match: { type: 'call', callee: 'args',    receiver: '^env$' }, label: 'std::env::args()', provenance: 'cli' },
+  { kind: 'source', id: 'rs-env-args-os',language: 'rs', framework: 'std', match: { type: 'call', callee: 'args_os', receiver: '^env$' }, label: 'std::env::args_os()', provenance: 'cli' },
+
+  // ─── SINKS (Rust) ─────────────────────────────────────────────────────────
+  // parser-rust.js accumulates chain arguments INNERMOST-first (source order),
+  // so on a builder chain like `sqlx::query(&sql).bind(x).fetch_all(pool)` the
+  // SQL text is arg 0 whichever terminal method the chain ends on, and on
+  // `Command::new("sh").arg("-c").arg(x).output()` the literal program name is
+  // arg 0. Terminal-method entries below are receiver-scoped to the chain root.
+  // `sqlx::query!(…)` keeps its `!` in the callee (`sqlx.query!`) and is never
+  // matched: it is the compile-time-checked, parameterized form.
+  { kind: 'sink', id: 'rs-sql-query',        language: 'rs', framework: 'sqlx/postgres/mysql/rusqlite', match: { type: 'call', callee: 'query', receiverExclude: '^(?:warp|uri|url|Url|Uri)$' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (query with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Keep the SQL text a literal and bind the value: `sqlx::query("SELECT * FROM t WHERE id = $1").bind(id)`, `client.query("… WHERE id = $1", &[&id])`, or `conn.query_row("… WHERE id = ?1", params![id], …)`. Never build SQL with format!/concat from request data.' } },
+  { kind: 'sink', id: 'rs-sql-query-as',     language: 'rs', framework: 'sqlx', match: { type: 'call', callee: 'query_as' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (sqlx::query_as with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use `sqlx::query_as::<_, T>("… WHERE id = $1").bind(id)` or the compile-checked `sqlx::query_as!(T, "… $1", id)`.' } },
+  { kind: 'sink', id: 'rs-sql-query-scalar', language: 'rs', framework: 'sqlx', match: { type: 'call', callee: 'query_scalar' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (sqlx::query_scalar with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use `sqlx::query_scalar("… WHERE id = $1").bind(id)` or `sqlx::query_scalar!`.' } },
+  { kind: 'sink', id: 'rs-sql-raw-sql',      language: 'rs', framework: 'sqlx', match: { type: 'call', callee: 'raw_sql' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (sqlx::raw_sql)', severity: 'critical', cwe: 'CWE-89',
+            remediation: '`raw_sql` cannot bind parameters; switch to `sqlx::query("…$1").bind(value)` for anything derived from input.' } },
+  { kind: 'sink', id: 'rs-sql-diesel-sql-query', language: 'rs', framework: 'diesel', match: { type: 'call', callee: 'sql_query' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (diesel::sql_query with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Bind with `diesel::sql_query("… WHERE id = $1").bind::<Integer, _>(id)`, or use the typed query DSL instead of raw SQL.' } },
+  { kind: 'sink', id: 'rs-sql-diesel-sql',   language: 'rs', framework: 'diesel', match: { type: 'call', callee: 'sql', receiver: '^(?:diesel|dsl)$' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (diesel::dsl::sql fragment from input)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'A `sql()` fragment is spliced verbatim; keep it a literal and pass values via `.bind()` or the typed DSL.' } },
+  { kind: 'sink', id: 'rs-sql-execute',      language: 'rs', framework: 'rusqlite/postgres/mysql', match: { type: 'call', callee: 'execute', receiverExclude: '^(?:Command|cmd|command|process)$' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (execute with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Keep the statement a literal and bind: `conn.execute("INSERT INTO t (a) VALUES (?1)", params![a])` / `client.execute("… $1", &[&a])`.' } },
+  { kind: 'sink', id: 'rs-sql-execute-batch',language: 'rs', framework: 'rusqlite', match: { type: 'call', callee: 'execute_batch' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (execute_batch with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: '`execute_batch` runs unparameterized SQL; split into single `execute` calls with `params![…]` for any value from input.' } },
+  { kind: 'sink', id: 'rs-sql-batch-execute',language: 'rs', framework: 'postgres', match: { type: 'call', callee: 'batch_execute' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (batch_execute with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: '`batch_execute` takes no parameters; use `client.execute("… $1", &[&value])` for input-derived values.' } },
+  { kind: 'sink', id: 'rs-sql-prepare',      language: 'rs', framework: 'rusqlite/postgres', match: { type: 'call', callee: 'prepare' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (prepare with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Preparing a statement does not parameterize text that was already interpolated. Use `?1`/`$1` placeholders in a literal and pass values at execution time.' } },
+  { kind: 'sink', id: 'rs-sql-prepare-cached',language: 'rs', framework: 'rusqlite', match: { type: 'call', callee: 'prepare_cached' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (prepare_cached with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use `?1` placeholders in a literal statement and pass values via `params![…]`.' } },
+  { kind: 'sink', id: 'rs-sql-query-row',    language: 'rs', framework: 'rusqlite', match: { type: 'call', callee: 'query_row' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (query_row with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Use `conn.query_row("SELECT … WHERE id = ?1", params![id], |r| …)`.' } },
+  { kind: 'sink', id: 'rs-sql-query-map',    language: 'rs', framework: 'rusqlite', match: { type: 'call', callee: 'query_map', receiver: '^(?:conn|db|connection|stmt)$' }, argIndex: 0,
+    vuln: { name: 'SQL Injection (query_map with runtime-built SQL)', severity: 'critical', cwe: 'CWE-89',
+            remediation: 'Prepare a literal statement with `?1` placeholders and pass values via `params![…]`.' } },
+  ...['fetch_all', 'fetch_one', 'fetch_optional', 'fetch', 'fetch_many', 'bind', 'persistent'].map(method => (
+    { kind: 'sink', id: `rs-sqlx-chain-${method}`, language: 'rs', framework: 'sqlx', match: { type: 'call', callee: method, receiver: '^(?:query|query_as|query_scalar|raw_sql|sql_query)$' }, argIndex: 0,
+      vuln: { name: `SQL Injection (sqlx query chain .${method} with runtime-built SQL)`, severity: 'critical', cwe: 'CWE-89',
+              remediation: 'Keep the SQL literal and bind values: `sqlx::query("SELECT * FROM t WHERE id = $1").bind(id).fetch_all(pool)`; only the placeholder form is parameterized.' } }
+  )),
+  // Command injection. `Command::new(<tainted>)` is always dangerous (the
+  // program itself comes from input). Everything else is only shell-interpreted
+  // when the program is a literal shell (`sh -c`), gated by requireLiteralArg on
+  // arg 0 (the innermost `Command::new` argument); `Command::new("ls").arg(x)`
+  // never invokes a shell and does not fire.
+  { kind: 'sink', id: 'rs-command-new-program', language: 'rs', framework: 'std::process', match: { type: 'call', callee: 'new', receiver: '^Command$' }, argIndex: 0,
+    vuln: { name: 'Command Injection (Command::new with input-derived program)', severity: 'high', cwe: 'CWE-78',
+            remediation: 'Resolve the program from a fixed allow-list (`match name { "ls" => "/bin/ls", … }`) instead of passing request data to `Command::new`.' } },
+  ...['arg', 'args', 'output', 'status', 'spawn', 'env', 'current_dir', 'stdin', 'stdout', 'stderr'].map(method => (
+    { kind: 'sink', id: `rs-command-shell-${method}`, language: 'rs', framework: 'std::process',
+      match: { type: 'call', callee: method, receiver: '^Command$', requireLiteralArg: { index: 0, pattern: '^"(?:/bin/|/usr/bin/)?(?:sh|bash|zsh|dash|ksh)"$|^"cmd(?:\\.exe)?"$|^"powershell(?:\\.exe)?"$|^"pwsh"$' } }, argIndex: 'all',
+      vuln: { name: 'Command Injection (Command::new("sh").arg("-c") with input-derived arguments)', severity: 'critical', cwe: 'CWE-78',
+              remediation: 'Drop the shell: `Command::new("ping").arg("-c").arg("1").arg(&host)` passes argv directly and never interprets metacharacters. If a shell is unavoidable, allow-list the value or quote it with `shell_escape::escape`.' } }
+  )),
+  // Path traversal: std::fs / tokio::fs / async_std::fs free functions, and
+  // File / OpenOptions constructors. `Path::new(x).join(y)` is not itself a
+  // sink; the access is. A canonicalize + starts_with containment check in the
+  // sink window is recognized by engine.js's dropGuardedFindings.
+  ...['read', 'read_to_string', 'read_dir', 'write', 'remove_file', 'remove_dir', 'remove_dir_all', 'create_dir', 'create_dir_all', 'copy', 'rename', 'hard_link', 'symlink', 'metadata', 'read_link', 'set_permissions'].map(method => (
+    { kind: 'sink', id: `rs-fs-${method}`, language: 'rs', framework: 'std::fs', match: { type: 'call', callee: method, receiver: '^fs$' }, argIndex: 'all',
+      vuln: { name: `Path Traversal (fs::${method} with input-derived path)`, severity: 'high', cwe: 'CWE-22',
+              remediation: 'Join onto a fixed base, canonicalize, and reject anything outside it: `let p = base.join(name).canonicalize()?; if !p.starts_with(&base) { return Err(…) }`. Reject `..` and absolute paths before use.' } }
+  )),
+  ...['open', 'create', 'create_new', 'options'].map(method => (
+    { kind: 'sink', id: `rs-file-${method}`, language: 'rs', framework: 'std::fs', match: { type: 'call', callee: method, receiver: '^(?:File|OpenOptions)$' }, argIndex: 0,
+      vuln: { name: `Path Traversal (File::${method} with input-derived path)`, severity: 'high', cwe: 'CWE-22',
+              remediation: 'Canonicalize the joined path and verify `starts_with(base)` before opening; or map the input to a fixed set of known file names.' } }
+  )),
+  // Reflected XSS: an HTML body built from input. `HttpResponse::Ok().body(x)`
+  // (actix), `Html(x)` (axum), `RawHtml(x)` (rocket), `warp::reply::html(x)`.
+  { kind: 'sink', id: 'rs-actix-body', language: 'rs', framework: 'actix', match: { type: 'call', callee: 'body', receiver: '^(?:HttpResponse|HttpResponseBuilder|Response)$' }, argIndex: 'all',
+    vuln: { name: 'Cross-Site Scripting (response body built from input)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Escape before interpolating: `html_escape::encode_text(&name)`, or render through an auto-escaping template engine (askama, tera) instead of `format!` into the body.' } },
+  { kind: 'sink', id: 'rs-axum-html', language: 'rs', framework: 'axum', match: { type: 'call', callee: 'Html', receiverExclude: '^__rs_extract__$' }, argIndex: 0,
+    vuln: { name: 'Cross-Site Scripting (axum Html response built from input)', severity: 'high', cwe: 'CWE-79',
+            remediation: '`Html(format!(…))` sends the string verbatim. Escape with `html_escape::encode_text` or return an askama/maud template, which escapes by default.' } },
+  { kind: 'sink', id: 'rs-rocket-rawhtml', language: 'rs', framework: 'rocket', match: { type: 'call', callee: 'RawHtml' }, argIndex: 0,
+    vuln: { name: 'Cross-Site Scripting (rocket RawHtml response built from input)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Return a `Template::render` (auto-escaped) or escape the value with `html_escape::encode_text` before wrapping it in `RawHtml`.' } },
+  { kind: 'sink', id: 'rs-warp-reply-html', language: 'rs', framework: 'warp', match: { type: 'call', callee: 'html', receiver: '^reply$' }, argIndex: 0,
+    vuln: { name: 'Cross-Site Scripting (warp::reply::html built from input)', severity: 'high', cwe: 'CWE-79',
+            remediation: 'Escape with `html_escape::encode_text` or render an auto-escaping template before `warp::reply::html`.' } },
+  // SSRF: outbound HTTP clients given an input-derived URL.
+  ...['get', 'post', 'put', 'patch', 'delete', 'head', 'request'].map(method => (
+    { kind: 'sink', id: `rs-http-client-${method}`, language: 'rs', framework: 'reqwest/ureq', match: { type: 'call', callee: method, receiver: '^(?:reqwest|ureq|isahc|surf|Client|client|http_client|http)$' }, argIndex: 'all',
+      vuln: { name: `Server-Side Request Forgery (HTTP client ${method} with input-derived URL)`, severity: 'high', cwe: 'CWE-918',
+              remediation: 'Parse with `url::Url::parse`, then allow-list the scheme and host (and reject loopback/RFC1918/169.254.169.254) before the request is sent.' } }
+  )),
+  // Open redirect.
+  ...['to', 'temporary', 'permanent', 'see_other', 'found', 'moved'].map(method => (
+    { kind: 'sink', id: `rs-redirect-${method}`, language: 'rs', framework: 'web', match: { type: 'call', callee: method, receiver: '^Redirect$' }, argIndex: 0,
+      vuln: { name: `Open Redirect (Redirect::${method} with input-derived target)`, severity: 'medium', cwe: 'CWE-601',
+              remediation: 'Only redirect to relative paths you validate (`target.starts_with(\'/\') && !target.starts_with("//")`) or to hosts on an allow-list.' } }
+  )),
+  { kind: 'sink', id: 'rs-actix-insert-header', language: 'rs', framework: 'actix', match: { type: 'call', callee: 'insert_header', receiver: '^HttpResponse$' }, argIndex: 'all',
+    vuln: { name: 'Header Injection / Open Redirect (response header set from input)', severity: 'medium', cwe: 'CWE-113',
+            remediation: 'Validate the value against an allow-list and strip CR/LF; for Location headers only allow relative paths or allow-listed hosts.' } },
+  // Log injection (low): request data written into structured logs unchanged.
+  ...['info', 'warn', 'error', 'debug', 'trace'].map(macro => (
+    { kind: 'sink', id: `rs-log-${macro}`, language: 'rs', framework: 'log/tracing', match: { type: 'call', callee: `${macro}!` }, argIndex: 0,
+      vuln: { name: `Log Injection (${macro}! with input-derived content)`, severity: 'low', cwe: 'CWE-117',
+              remediation: 'Log input as a structured field (`tracing::info!(user = %name, "login")`) or strip CR/LF so a request cannot forge log lines.' } }
+  )),
+  // Deserialization of input with format-level object construction.
+  ...['from_slice', 'from_reader', 'from_str'].map(method => (
+    { kind: 'sink', id: `rs-serde-pickle-${method}`, language: 'rs', framework: 'serde_pickle', match: { type: 'call', callee: method, receiver: '^serde_pickle$' }, argIndex: 0,
+      vuln: { name: `Deserialization of Untrusted Data (serde_pickle::${method})`, severity: 'medium', cwe: 'CWE-502',
+              remediation: 'Pickle can encode arbitrary object construction; deserialize input with serde_json/serde into a concrete typed struct instead.' } }
+  )),
+  { kind: 'sink', id: 'rs-bincode-deserialize', language: 'rs', framework: 'bincode', match: { type: 'call', callee: 'deserialize', receiver: '^bincode$' }, argIndex: 0,
+    vuln: { name: 'Deserialization of Untrusted Data (bincode::deserialize without size limits)', severity: 'medium', cwe: 'CWE-502',
+            remediation: 'Use `bincode::DefaultOptions::new().with_limit(MAX)` so a length prefix from input cannot drive a huge allocation, and deserialize into a concrete type.' } },
+  // Unbounded allocation driven by input.
+  { kind: 'sink', id: 'rs-with-capacity', language: 'rs', framework: 'std', match: { type: 'call', callee: 'with_capacity', receiver: '^(?:Vec|String|HashMap|HashSet|VecDeque|BTreeMap)$' }, argIndex: 0,
+    vuln: { name: 'Uncontrolled Resource Consumption (with_capacity sized by input)', severity: 'medium', cwe: 'CWE-770',
+            remediation: 'Clamp the requested size: `Vec::with_capacity(n.min(MAX_ITEMS))`, or grow lazily with `Vec::new()` and push.' } },
+
+  // ─── SANITIZERS (Rust) ────────────────────────────────────────────────────
+  // `x.parse::<i64>()` is a numeric parse; `Url::parse` is not a sanitizer of
+  // anything, so it is excluded by receiver.
+  { kind: 'sanitizer', id: 'rs-parse-numeric', language: 'rs', match: { type: 'call', callee: 'parse', receiverExclude: '^(?:Url|Uri|url|reqwest|Path|PathBuf|serde_json|json|toml|serde_yaml)$' }, effect: 'strip', appliesTo: ['*'] },
+  { kind: 'sanitizer', id: 'rs-html-escape-encode-text', language: 'rs', match: { type: 'call', callee: 'encode_text' }, effect: 'strip', appliesTo: ['xss'] },
+  { kind: 'sanitizer', id: 'rs-html-escape-encode-safe', language: 'rs', match: { type: 'call', callee: 'encode_safe' }, effect: 'strip', appliesTo: ['xss'] },
+  { kind: 'sanitizer', id: 'rs-html-escape-attr', language: 'rs', match: { type: 'call', callee: 'encode_double_quoted_attribute' }, effect: 'strip', appliesTo: ['xss'] },
+  { kind: 'sanitizer', id: 'rs-ammonia-clean', language: 'rs', match: { type: 'call', callee: 'clean', receiver: '^ammonia$' }, effect: 'strip', appliesTo: ['xss'] },
+  { kind: 'sanitizer', id: 'rs-askama-escape', language: 'rs', match: { type: 'call', callee: 'escape', receiver: '^(?:askama|v_htmlescape|html_escape|tera)$' }, effect: 'strip', appliesTo: ['xss'] },
+  { kind: 'sanitizer', id: 'rs-shell-escape', language: 'rs', match: { type: 'call', callee: 'escape', receiver: '^shell_escape$' }, effect: 'strip', appliesTo: ['cmd'] },
+  { kind: 'sanitizer', id: 'rs-shlex-quote', language: 'rs', match: { type: 'call', callee: 'quote', receiver: '^shlex$' }, effect: 'strip', appliesTo: ['cmd'] },
+  { kind: 'sanitizer', id: 'rs-shlex-try-quote', language: 'rs', match: { type: 'call', callee: 'try_quote', receiver: '^shlex$' }, effect: 'strip', appliesTo: ['cmd'] },
+  { kind: 'sanitizer', id: 'rs-sanitize-filename', language: 'rs', match: { type: 'call', callee: 'sanitize', receiver: '^sanitize_filename$' }, effect: 'strip', appliesTo: ['path'] },
+  { kind: 'sanitizer', id: 'rs-path-file-name', language: 'rs', match: { type: 'call', callee: 'file_name' }, effect: 'strip', appliesTo: ['path'] },
+  { kind: 'sanitizer', id: 'rs-percent-encode', language: 'rs', match: { type: 'call', callee: 'utf8_percent_encode' }, effect: 'strip', appliesTo: ['url'] },
 ];
 
 // ─── Expanded sanitizer catalog (v0.65.0) ────────────────────────────────
@@ -1458,6 +2199,7 @@ const _LANG_EXT = {
   php:  /\.(?:php|phtml)$/i,
   rb:   /\.rb$/i,
   java: /\.java$/i,
+  rs:   /\.rs$/i,
 };
 
 // cpp delegates to cppExtRe() rather than duplicating a literal set, so it
@@ -1778,7 +2520,25 @@ function _calleeIndexHits(calleeExpr) {
   return raw;
 }
 
-export function matchSource(expr, file) {
+// SARD_80_F1 W4.C39 — `receiverType` (optional 3rd param) is the SOURCE-side
+// counterpart of `matchSinkOrSanitizer`'s existing receiverType param, closing
+// a gap W4.C32 found and explicitly deferred: matchSource's CALL-shaped
+// branch used to filter ONLY via `_receiverAllowed` (a name regex), with no
+// way for a `receiverTypeIn`-bearing source entry (`cs-datareader-*`) to
+// confirm a match via CHA-resolved declared type the way a sink already
+// could. W4.C32 built and verified this exact mechanism once already, then
+// reverted it — at the time, `classOfVar`'s CHA only resolved `new Foo()`
+// allocations, and `SqlDataReader` has no public constructor (always
+// obtained via `command.ExecuteReader()`, a factory method), so the
+// mechanism was correct but had no way to ever actually resolve the type it
+// needed. That blocker is gone: `class-hierarchy.js`'s `typeOfVar` now also
+// captures a local's DECLARED type off `Type x = expr;` (parser-cs.js's
+// `declaredType`, added independently for a different consumer), which
+// covers a factory-returned value exactly as well as a `new` one — verified
+// directly that `classOfVar` now resolves `dr` to `SqlDataReader` for
+// `using (SqlDataReader dr = command.ExecuteReader())`. Re-attempting the
+// SAME mechanism W4.C32 already designed is what actually unlocks it now.
+export function matchSource(expr, file, receiverType) {
   if (!expr) return null;
   // Member sources (req.query): the original path — unchanged.
   if (expr.kind === 'member' && expr.object?.kind === 'ident') {
@@ -1816,10 +2576,39 @@ export function matchSource(expr, file) {
     if (raw.length) {
       const hits = filterByProvenance(raw)
         .filter(h => _languageAllowed(h, file))
-        .filter(h => _receiverAllowed(h, expr.callee));
+        .filter(h => _receiverAllowed(h, expr.callee) || _receiverTypeConfirms(h, receiverType));
       const s = hits.find(h => h.kind === 'source');
       if (s) return s;
     }
+    // SARD_80_F1 W4.C27 — a value-accessor method called ON an already-
+    // registered MEMBER source (`req.Params.Get("name")`,
+    // `req.QueryString.Get("id")` — .NET's `NameValueCollection` read API,
+    // equivalent to its own indexer `req.Params["name"]`, which already
+    // matched via the branch above) was invisible here: the callee is a
+    // flat dotted STRING for C#'s hand-rolled parser ("req.Params.Get"),
+    // and `_calleeIndexHits` only ever consults CALLEE_INDEX (call-type
+    // catalog entries) — a MEMBER-type source like `cs-req-params` lives in
+    // MEMBER_INDEX under the key "req.Params" and was never looked up here
+    // at all. Confirmed against the public C# mirror
+    // (CWE78_OS_Command_Injection__Params_Get_Web_01.cs): the indexer form
+    // already fired via IR-TAINT; the `.Get(...)` form produced zero
+    // findings. Strip the callee's last dotted segment and, when it's one
+    // of the small set of known NameValueCollection read accessors, look
+    // that prefix up in MEMBER_INDEX exactly as the plain-member branch
+    // above does.
+    if (typeof expr.callee === 'string' && expr.callee.includes('.')) {
+      const lastDot = expr.callee.lastIndexOf('.');
+      const method = expr.callee.slice(lastDot + 1);
+      if (/^(?:Get|GetValues|GetKey)$/.test(method)) {
+        const prefix = expr.callee.slice(0, lastDot);
+        const raw2 = MEMBER_INDEX.get(prefix);
+        if (raw2) {
+          const hits = filterByProvenance(raw2).filter(h => _languageAllowed(h, file));
+          const s = hits.find(h => h.kind === 'source');
+          if (s) return s;
+        }
+      }
+    }
   }
   return null;
 }