@clear-capabilities/agentic-security-scanner 0.151.3 → 0.153.0

package/src/posture/csharp-analysis.js

@@ -10,7 +10,16 @@
 //   are stable enough (Request.Query / Request.Form / Request.Headers /
 //   HttpContext.Request.* / IFormCollection / BinaryReader / etc.) that a
 //   simple forward-pass catches the vast majority. Misses on:
-//     - Aliased sources via method indirection (caller-supplied taint)
+//     - Aliased sources via method indirection (caller-supplied taint) —
+//       SARD_80_F1 W4.C41 closed the SAME-FILE, SINGLE-HOP case (a value
+//       tainted in a caller passed as an argument to a private/same-class
+//       helper — Juliet's own "data passed as an argument from one method
+//       to another in the same class" flow-variant idiom): see
+//       `analyzeCSharpIR`'s post-pass below. Still deliberately NOT
+//       modeled: a second hop (the helper passes it on to a THIRD method)
+//       and any cross-FILE call, both out of scope for this lightweight
+//       analyzer (the real, general interprocedural case is what the deep
+//       taint engine in `dataflow/` exists for).
 //     - Inheritance-resolved property reads
 //     - Generic constraints
 //   The Layer 4 LLM validator stage covers the residue when enabled.
@@ -101,6 +110,53 @@ function isSanitizedExpr(text) {
   return false;
 }
 
+// SARD_80_F1 W3.x — `TAINT_SOURCE_PATTERNS`'s `StreamReader.ReadLine` /
+// `BinaryReader.ReadString` entries require the LITERAL type name as the
+// receiver, which real code never writes (`StreamReader.ReadLine()` isn't
+// even a static method) — idiomatic C# always calls through an INSTANCE
+// variable (`using (StreamReader sr = …) { sr.ReadLine() }`), so those
+// patterns were effectively dead against this dominant shape. Exposed (not
+// created) by the `resolveCalleeReturnTaint` precision fix above: the old
+// identifier-name fallback used to accidentally re-taint the result via an
+// unrelated already-tainted variable merely appearing in the call text
+// (the exact over-tainting bug this fix removes), which happened to produce
+// the right verdict here for the wrong reason. Mirrors
+// `HTTP_TAINTED_PARAM_TYPES`'s type-based approach: a call through a
+// variable whose DECLARED type is a reader class is a source regardless of
+// the variable's name.
+const READER_SOURCE_TYPES = /^(?:StreamReader|BinaryReader|TextReader)$/;
+const READER_SOURCE_CALL_RE = /\b([A-Za-z_]\w*)\s*\.\s*(?:ReadLine|ReadToEnd|ReadString|ReadAllText|ReadAllLines)\s*\(/g;
+// SARD_80_F1 W4.C34 — a second reader-shaped type/method pair, same class of
+// gap as the StreamReader one above: `SqlDataReader dr = command.ExecuteReader();
+// data = dr.GetString(1);` (Juliet's own idiomatic ADO.NET shape, confirmed
+// via the public C# mirror, `CWE23_Relative_Path_Traversal__Database_01.cs`)
+// is a real database-row read every bit as untrusted as a file/stream read,
+// but `dataflow/catalog.js`'s OWN separate `cs-datareader-*` source entries
+// (a completely different detector, the deep taint engine, not this file's
+// lexical type-flow) require the LITERAL variable-name substring "reader" —
+// investigated and found genuinely inert there too (W4.C32/W4.C33: giving
+// THAT engine receiver-type confirmation is real but doesn't help here,
+// since `classOfVar`'s CHA only resolves `new Foo()` allocations, never a
+// factory-method return like `ExecuteReader()` — a separate, deeper
+// limitation, not this file's concern). THIS detector already has exactly
+// the right mechanism (declared-type lookup via `typeMap`, independent of
+// variable name) — it just never had a DataReader entry.
+const DATAREADER_SOURCE_TYPES = /^(?:Sql|OleDb|Odbc|MySql|Npgsql|Sqlite)DataReader$/;
+const DATAREADER_SOURCE_CALL_RE = /\b([A-Za-z_]\w*)\s*\.\s*(?:GetString|GetValue|GetInt16|GetInt32|GetInt64|GetDateTime|GetDecimal|GetDouble|GetFloat|GetBoolean|GetGuid|GetChar|GetByte)\s*\(/g;
+function _typedReaderSourceCall(text, typeMap) {
+  if (!text) return false;
+  READER_SOURCE_CALL_RE.lastIndex = 0;
+  let m;
+  while ((m = READER_SOURCE_CALL_RE.exec(text))) {
+    if (READER_SOURCE_TYPES.test(typeMap.get(m[1]) || '')) return true;
+  }
+  DATAREADER_SOURCE_CALL_RE.lastIndex = 0;
+  while ((m = DATAREADER_SOURCE_CALL_RE.exec(text))) {
+    if (DATAREADER_SOURCE_TYPES.test(typeMap.get(m[1]) || '')) return true;
+  }
+  return false;
+}
+
 // For each SANITIZER_PATTERNS match in `text`, find the nearest `(...)` call
 // span after the match and return its [start, end) bounds. Used to tell
 // "the sanitizer call actually wraps the tainted value" (HtmlEncode(x)) apart
@@ -154,6 +210,43 @@ function _refEscapesSanitizers(text, ref, spans) {
 // HttpRequest, the data inside it is by definition user-controlled.
 const HTTP_TAINTED_PARAM_TYPES = /^(?:HttpRequest(?:Base|Message)?|HttpListenerRequest|HttpResponseBase|HttpResponse|HttpResponseMessage|HttpContext(?:Base)?|IPrincipal|HttpListenerContext|HttpServletRequest|HttpServletResponse|IFormCollection|IFormFile|IFormFileCollection|Stream|StreamReader|BinaryReader|TextReader|HttpListener)$/;
 
+// SARD_80_F1 W3.x — is `text` (the ENTIRE trimmed expression, not merely a
+// substring) exactly one call `Name(args…)`, with nothing before the name
+// (besides an optional `this.`) and nothing after the matching close-paren?
+// Used to decide when a call-shaped RHS/return can be resolved against its
+// OWN callee's return-taint verdict instead of the identifier-name fallback
+// below (which cannot distinguish "the callee's return derives from this
+// argument" from "this argument's tainted NAME merely appears in the call
+// text", the latter being exactly W4.J17's documented `argIsTainted`
+// over-tainting bug: `data = GoodG2BSource(req, resp);` taints `data`
+// purely because `req`/`resp` are unconditionally-tainted HTTP-typed
+// params, even though `GoodG2BSource` never reads them).
+function _asBareCall(text) {
+  if (!text) return null;
+  const t = text.trim();
+  const m = t.match(/^(?:this\s*\.\s*)?([A-Za-z_]\w*)\s*\(/);
+  if (!m) return null;
+  const openIdx = t.indexOf('(', m[0].length - 1);
+  let depth = 0;
+  for (let i = openIdx; i < t.length; i++) {
+    if (t[i] === '(') depth++;
+    else if (t[i] === ')') {
+      depth--;
+      if (depth === 0) return i === t.length - 1 ? m[1] : null;
+    }
+  }
+  return null;
+}
+
+// The pre-existing "any tainted identifier's name appears in the text"
+// fallback, factored out so both the propagation loop and the return-taint
+// computation below share one definition.
+function _identRefTainted(text, taintMap) {
+  const refs = (text.match(/\b[A-Za-z_]\w*\b/g) || []);
+  for (const ref of refs) if (taintMap.get(ref)) return true;
+  return false;
+}
+
 function analyzeMethodFlow(method, opts = {}) {
   const typeMap = new Map();
   const taintMap = new Map();
@@ -167,62 +260,109 @@ function analyzeMethodFlow(method, opts = {}) {
   // ADDITIONALLY: any parameter whose TYPE is an HTTP context type
   // (HttpRequest, HttpResponse, IFormCollection, …) is tainted regardless
   // of opts — the data IN those types is by definition user-controlled.
+  // `opts.taintedParamNames` (SARD_80_F1 W4.C41, optional Set<string>) is
+  // the SAME-FILE, single-hop caller-argument-taint case referenced above:
+  // `analyzeCSharpIR`'s post-pass computes, from an ALREADY-computed
+  // caller flow, which of THIS method's own parameter names were passed a
+  // tainted argument at some real call site, and re-invokes this function
+  // with that set so the normal forward pass below propagates it through
+  // this method's body exactly as it would a route-handler-tainted param.
   const paramsTainted = !!opts.treatParamsAsTainted;
+  const taintedParamNames = opts.taintedParamNames || null;
   for (const p of method.params || []) {
     typeMap.set(p.name, p.type);
     const typeBase = String(p.type || '').replace(/\?$/, '').replace(/<.*$/, '');
     const isHttpTaintedType = HTTP_TAINTED_PARAM_TYPES.test(typeBase);
-    if (paramsTainted || isHttpTaintedType) {
+    const isCallerArgTainted = !!(taintedParamNames && taintedParamNames.has(p.name));
+    if (paramsTainted || isHttpTaintedType || isCallerArgTainted) {
       taintMap.set(p.name, true);
       sourceLines.set(p.name, method.line);
     }
   }
 
-  // Forward pass through decls. Method.decls is already in source order.
-  for (const d of method.decls || []) {
-    if (d.type && d.type !== 'var') typeMap.set(d.name, d.type);
-    else if (d.isVar && d.rhsText) {
-      // Best-effort type inference for `var x = new T(...)`.
-      const m = d.rhsText.match(/^\s*new\s+([\w.<>?\[\],\s]+?)\s*\(/);
-      if (m) typeMap.set(d.name, m[1].trim());
-    }
-    if (d.rhsText) {
-      if (isSourceExpr(d.rhsText) && !isSanitizedExpr(d.rhsText)) {
-        taintMap.set(d.name, true);
-        sourceLines.set(d.name, d.line);
-        continue;
-      }
-      // Propagation: rhs references a tainted var → lhs becomes tainted.
-      const refs = (d.rhsText.match(/\b[A-Za-z_]\w*\b/g) || []);
-      for (const ref of refs) {
-        if (taintMap.get(ref)) {
-          taintMap.set(d.name, true);
-          sourceLines.set(d.name, d.line);
-          break;
-        }
+  // Single forward pass, in TRUE source-line order, over decls AND
+  // assignments merged together.
+  //
+  // Previously this ran as two SEPARATE forward passes — all of
+  // method.decls, then all of method.assignments — each individually in
+  // source order, but with no ordering between the two lists. Juliet's own
+  // universal C# convention (confirmed via the public Juliet C# mirror this
+  // project's SARD manifest pins) declares a source variable bare, then
+  // assigns it on the next line: `string data; data = Environment.
+  // GetEnvironmentVariable("ADD");` — a plain decl (no rhsText, doesn't
+  // taint) followed by a SEPARATE ASSIGNMENT (which does). Any LATER
+  // declare-with-initializer that reads that variable (`string[] tokens =
+  // data.Split(...);`) is a decl, processed in the FIRST loop — before the
+  // assignment that actually taints `data` had run in the SECOND loop — so
+  // the propagation check saw `data` as not-yet-tainted and the dependent
+  // variable silently stayed clean, regardless of true source order.
+  // Reproduced down to a minimal 100%-failing case (SARD_80_F1 W4.C8) and
+  // confirmed real (not Juliet-specific): any C# code that separately
+  // assigns a source, then derives a value from it in a later declared
+  // variable, hits this. Fixing it can only ADD correctly-propagated taint
+  // (this model has no un-taint step — a value that starts tainted stays
+  // tainted — so re-ordering never removes a propagation that used to fire).
+  const decls = (method.decls || []).map(d => ({ kind: 'decl', line: d.line, item: d }));
+  const assigns = (method.assignments || []).map(a => ({ kind: 'assign', line: a.line, item: a }));
+  const merged = decls.concat(assigns).sort((x, y) => x.line - y.line);
+  for (const { kind, item } of merged) {
+    const targetKey = kind === 'decl' ? item.name : item.fullTarget;
+    const rhsText = item.rhsText;
+    if (kind === 'decl') {
+      if (item.type && item.type !== 'var') typeMap.set(item.name, item.type);
+      else if (item.isVar && rhsText) {
+        // Best-effort type inference for `var x = new T(...)`.
+        const m = rhsText.match(/^\s*new\s+([\w.<>?\[\],\s]+?)\s*\(/);
+        if (m) typeMap.set(item.name, m[1].trim());
       }
     }
-  }
-
-  // Then assignments — same forward propagation rules.
-  for (const a of method.assignments || []) {
-    if (!a.rhsText) continue;
-    const targetKey = a.fullTarget;
-    if (isSourceExpr(a.rhsText) && !isSanitizedExpr(a.rhsText)) {
+    if (!rhsText) continue;
+    if ((isSourceExpr(rhsText) || _typedReaderSourceCall(rhsText, typeMap)) && !isSanitizedExpr(rhsText)) {
       taintMap.set(targetKey, true);
-      sourceLines.set(targetKey, a.line);
+      sourceLines.set(targetKey, item.line);
       continue;
     }
-    const refs = (a.rhsText.match(/\b[A-Za-z_]\w*\b/g) || []);
-    for (const ref of refs) {
-      if (taintMap.get(ref)) {
-        taintMap.set(targetKey, true);
-        sourceLines.set(targetKey, a.line);
-        break;
-      }
+    // Propagation via a resolvable same-file call: consult the callee's OWN
+    // return-taint verdict (SARD_80_F1 W3.x) instead of the identifier-name
+    // fallback, which cannot tell "the callee's return actually derives
+    // from this argument" apart from "this argument's tainted NAME merely
+    // appears in the call text" — see `_asBareCall`'s header comment.
+    const bareCallName = _asBareCall(rhsText);
+    let resolved = null;
+    if (bareCallName && opts.resolveCalleeReturnTaint) {
+      resolved = opts.resolveCalleeReturnTaint(bareCallName);
+    }
+    if (resolved !== null) {
+      if (resolved) { taintMap.set(targetKey, true); sourceLines.set(targetKey, item.line); }
+      continue;
+    }
+    // Fallback: rhs references a tainted var → lhs becomes tainted. Reached
+    // for non-call RHS shapes, and for calls the resolver couldn't resolve
+    // (external/library callee, overload ambiguity, or a dependency cycle)
+    // — recall-preserving: an unresolved call keeps the old, more liberal
+    // behavior rather than silently going quiet.
+    if (_identRefTainted(rhsText, taintMap)) {
+      taintMap.set(targetKey, true);
+      sourceLines.set(targetKey, item.line);
     }
   }
-  return { typeMap, taintMap, sourceLines };
+  // Per-return taint verdict, so a CALLER can resolve a call to THIS method
+  // via the same mechanism (see `resolveCalleeReturnTaint` in
+  // `analyzeCSharpIR`). Same three-way resolution as the propagation loop
+  // above: an explicit source wins, then a resolvable nested call, then the
+  // identifier-name fallback.
+  const returns = (method.returns || []).map((r) => {
+    let tainted;
+    if ((isSourceExpr(r.exprText) || _typedReaderSourceCall(r.exprText, typeMap)) && !isSanitizedExpr(r.exprText)) {
+      tainted = true;
+    } else {
+      const bareCallName = _asBareCall(r.exprText);
+      const resolved = bareCallName && opts.resolveCalleeReturnTaint ? opts.resolveCalleeReturnTaint(bareCallName) : null;
+      tainted = resolved !== null ? resolved : _identRefTainted(r.exprText, taintMap);
+    }
+    return { line: r.line, tainted };
+  });
+  return { typeMap, taintMap, sourceLines, returns };
 }
 
 // Attribute → route classifier. Each entry maps an attribute name to
@@ -250,7 +390,7 @@ function extractPath(argsRaw, argIdx) {
   return null;
 }
 
-export function analyzeCSharpIR(ir) {
+export function analyzeCSharpIR(ir, opts = {}) {
   // Class-level attribute roll-up.
   const classAuth = new Map(); // class-ref → { authedAtClass, anonymousAtClass, isController }
   for (const c of ir.classes) {
@@ -278,6 +418,21 @@ export function analyzeCSharpIR(ir) {
   const methodFlow = new Map();
   const methodToClass = new Map();
   for (const c of ir.classes) for (const m of c.methods) methodToClass.set(m, c);
+  const classesByName = new Map();
+  for (const c of ir.classes) classesByName.set(c.name, c);
+  // SARD_80_F1 W3.x — resolve a same-file call's return-taint verdict
+  // instead of letting `analyzeMethodFlow`'s identifier-name fallback treat
+  // ANY tainted identifier appearing in the call text (including an
+  // argument the callee never reads) as tainting the result. Bare-name
+  // keyed (this codebase's call sites don't carry receiver/overload info to
+  // disambiguate further); a name with 0 or 2+ candidates is unresolvable
+  // (`null`, meaning "fall back to the old heuristic") rather than guessed.
+  const methodsByName = new Map();
+  for (const m of ir.methods) {
+    if (!methodsByName.has(m.name)) methodsByName.set(m.name, []);
+    methodsByName.get(m.name).push(m);
+  }
+  const treatParamsAsTaintedByMethod = new Map();
   for (const m of ir.methods) {
     const attrNames = (m.attrs || []).map(x => x.name);
     const isRouteAttr = attrNames.some(n => ROUTE_ATTRS[n]);
@@ -285,8 +440,151 @@ export function analyzeCSharpIR(ir) {
     const classIsController = cls ? !!classAuth.get(cls)?.isController : false;
     const classHasApiAttr = cls && (cls.attrs || []).some(a => a.name === 'ApiController' || a.name === 'Route');
     const isPublic = !m.modifiers || m.modifiers.includes('public') || (!m.modifiers.includes('private') && !m.modifiers.includes('protected') && !m.modifiers.includes('internal'));
-    const treatParamsAsTainted = (isRouteAttr || classHasApiAttr || classIsController) && isPublic;
-    methodFlow.set(m, analyzeMethodFlow(m, { treatParamsAsTainted }));
+    treatParamsAsTaintedByMethod.set(m, (isRouteAttr || classHasApiAttr || classIsController) && isPublic);
+  }
+  const calleeFlowCache = new Map();
+  const calleeReturnTaintMemo = new Map();
+  const resolvingStack = new Set();
+  function computeFlow(m) {
+    let flow = calleeFlowCache.get(m);
+    if (!flow) {
+      flow = analyzeMethodFlow(m, { treatParamsAsTainted: treatParamsAsTaintedByMethod.get(m), resolveCalleeReturnTaint });
+      calleeFlowCache.set(m, flow);
+    }
+    return flow;
+  }
+  function resolveCalleeReturnTaint(name) {
+    if (calleeReturnTaintMemo.has(name)) return calleeReturnTaintMemo.get(name);
+    const candidates = methodsByName.get(name);
+    if (!candidates || candidates.length !== 1) { calleeReturnTaintMemo.set(name, null); return null; }
+    const callee = candidates[0];
+    // Cycle guard (self- or mutually-recursive calls): unresolvable for
+    // THIS resolution, deliberately not memoized so a later, non-cyclic
+    // call to the same name can still resolve normally.
+    if (resolvingStack.has(callee)) return null;
+    resolvingStack.add(callee);
+    const flow = computeFlow(callee);
+    resolvingStack.delete(callee);
+    const tainted = flow.returns && flow.returns.length ? flow.returns.some(r => r.tainted) : null;
+    calleeReturnTaintMemo.set(name, tainted);
+    return tainted;
+  }
+  for (const m of ir.methods) methodFlow.set(m, computeFlow(m));
+
+  // SARD_80_F1 W4.C41 — same-file, single-hop caller-argument taint.
+  // Every detector in csharp.js reads `analysis.methodFlow.get(m)` and
+  // that flow's own `taintMap` only ever seeds from THIS method's own
+  // params (route-handler convention / HTTP-typed param) — never from
+  // what a CALLER actually passed it. Juliet's own "Flow Variant NN: data
+  // passed as an argument from one method to another in the same class"
+  // idiom (a route handler reads a source, then calls a private static
+  // sink-wrapper helper with it) was therefore invisible to every
+  // per-method detector here, confirmed via a standalone `runScan`
+  // reproduction of the exact real-corpus shape (CWE36's own
+  // `Params_Get_Web_41.cs`): the DIRECT single-method form of the same
+  // sink already fired correctly; the moment the tainted value crossed a
+  // same-file method-call boundary, it vanished with zero findings from
+  // any detector, structural or deep-engine.
+  //
+  // Deliberately conservative, matching this analyzer's own "single
+  // forward pass" simplicity rather than a full fixed point: (1) SINGLE
+  // HOP only — a callee that itself forwards the value to a THIRD method
+  // is not covered (mirrors `resolveCalleeReturnTaint`'s own scope, which
+  // is the established precedent for interprocedural resolution in this
+  // file); (2) SAME-FILE, unambiguous-name resolution only, via the same
+  // `methodsByName` index `resolveCalleeReturnTaint` already uses — a
+  // callee name with zero or 2+ same-named candidates project-wide is
+  // left unresolved (permissive: the finding is simply not gained, never
+  // a false suppression); (3) self-recursive calls are skipped (a
+  // parameter's own taint state within its own body is already handled
+  // by the normal forward pass, and re-seeding it from itself adds
+  // nothing); (4) this recomputes the DIRECT callee's flow only — it does
+  // NOT retroactively fix up `resolveCalleeReturnTaint`'s memo for any
+  // caller further up a chain that already resolved this callee's
+  // pre-this-pass return-taint verdict, an accepted, narrow gap given the
+  // single-hop scope above.
+  // SARD_80_F1 W5.31 — genuine cross-FILE extension of W5.30's same-file
+  // cross-class fix. This function has no visibility beyond its own `ir`
+  // (one file), so it cannot itself discover that `Sink.BadSink(data, …)`
+  // resolves to a static method declared in a DIFFERENT file — that
+  // project-wide resolution now happens one layer up, in
+  // `sast/csharp-cross-file.js`, which parses every `.cs` file in the
+  // project, finds a caller's tainted argument passed to a receiver-
+  // qualified call whose class lives in ANOTHER file, and re-invokes this
+  // function on the CALLEE's own file with the result seeded here via
+  // `opts.externalTaintedParams` (a `Map<methodObject, Set<paramName>>`,
+  // keyed by an object reference into THIS SAME `ir.methods` array — the
+  // caller resolves the callee from its own freshly-parsed copy of this
+  // exact `ir`, so the reference always matches). Seeding happens BEFORE
+  // the same-file loop below runs, and the two never conflict: the
+  // same-file loop only ever ADDS to whatever Set is already present for a
+  // callee (`if (!taintedParamNamesByMethod.has(callee)) …set(callee, new
+  // Set())`), so a param already seeded from across files is simply
+  // preserved, and a param seeded here that the same-file loop separately
+  // also proves tainted collapses harmlessly into the same Set entry.
+  const taintedParamNamesByMethod = new Map();
+  if (opts.externalTaintedParams) {
+    for (const [m, names] of opts.externalTaintedParams) {
+      taintedParamNamesByMethod.set(m, new Set(names));
+    }
+  }
+  for (const caller of ir.methods) {
+    const callerFlow = methodFlow.get(caller);
+    if (!callerFlow) continue;
+    for (const call of caller.calls || []) {
+      let candidates;
+      if (call.receiver) {
+        // SARD_80_F1 W5.30 — a receiver-qualified call (`Sink.BadSink(data,
+        // …)`) was unconditionally skipped here, same as any OTHER
+        // receiver-bearing call — Juliet's own cross-class "Flow Variant 51:
+        // data passed as an argument from one method to another in
+        // different classes in the same package" idiom (confirmed via the
+        // public C# mirror's own
+        // CWE36_..._Params_Get_Web_51a.cs/_51b.cs pair) was therefore
+        // invisible here even in the SAME FILE, let alone across files —
+        // confirmed by direct `runScan` reproduction showing ZERO findings
+        // from any detector for this shape, structural or deep-engine,
+        // before this fix. Resolvable ONLY when `call.receiver` is a REAL
+        // class declared in THIS file (`classesByName`, never an instance
+        // variable this analyzer has no type-tracking for) AND the matched
+        // candidate is `static` — the second check is load-bearing, not
+        // redundant: C# cannot compile `ClassName.InstanceMethod()` without
+        // an object reference, so if the resolved candidate is NOT static,
+        // `call.receiver`'s text is far more likely a coincidentally
+        // same-named INSTANCE VARIABLE than a genuine static-class
+        // qualifier, and treating it as one would silently invent a data-flow
+        // edge that doesn't exist — exactly the risk `byQname`'s own header
+        // comment in `callgraph.js` warns against for a structurally
+        // analogous ambiguity. Deliberately single-hop and same-file only,
+        // matching every other interprocedural mechanism in this file —
+        // cross-FILE resolution is a separate, larger undertaking (the deep
+        // taint engine's own `callgraph.js` already resolves cross-file
+        // static calls project-wide; this structural analyzer does not).
+        const cls = classesByName.get(call.receiver);
+        candidates = cls
+          ? (methodsByName.get(call.method) || []).filter(m => methodToClass.get(m) === cls && (m.modifiers || []).includes('static'))
+          : null;
+      } else {
+        candidates = methodsByName.get(call.method);
+      }
+      if (!candidates || candidates.length !== 1) continue;
+      const callee = candidates[0];
+      if (callee === caller) continue;
+      for (let i = 0; i < (call.args || []).length; i++) {
+        const param = (callee.params || [])[i];
+        if (!param) continue;
+        if (!argIsTainted(callerFlow, call.args[i])) continue;
+        if (!taintedParamNamesByMethod.has(callee)) taintedParamNamesByMethod.set(callee, new Set());
+        taintedParamNamesByMethod.get(callee).add(param.name);
+      }
+    }
+  }
+  for (const [callee, taintedParamNames] of taintedParamNamesByMethod) {
+    methodFlow.set(callee, analyzeMethodFlow(callee, {
+      treatParamsAsTainted: treatParamsAsTaintedByMethod.get(callee),
+      resolveCalleeReturnTaint,
+      taintedParamNames,
+    }));
   }
   // Route detection.
   const routes = [];

package/src/posture/finding-defaults.js

@@ -19,11 +19,14 @@ const _CWE_FAMILY = {
   'CWE-90':  'ldap-injection',
   'CWE-91':  'xpath-injection',
   'CWE-94':  'code-injection',
+  'CWE-95':  'code-injection',
+  'CWE-98':  'code-injection',
   'CWE-22':  'path-traversal',
   'CWE-23':  'path-traversal',
   'CWE-36':  'path-traversal',
   'CWE-200': 'info-disclosure',
   'CWE-209': 'info-disclosure',
+  'CWE-134': 'format-string',
   'CWE-256': 'hardcoded-secret',
   'CWE-259': 'hardcoded-secret',
   'CWE-287': 'broken-auth',
@@ -40,6 +43,7 @@ const _CWE_FAMILY = {
   'CWE-352': 'csrf',
   'CWE-384': 'session-fixation',
   'CWE-434': 'unrestricted-upload',
+  'CWE-470': 'code-injection',
   'CWE-502': 'insecure-deserialization',
   'CWE-601': 'open-redirect',
   'CWE-611': 'xxe',
@@ -50,7 +54,7 @@ const _CWE_FAMILY = {
   'CWE-776': 'xxe',
   'CWE-798': 'hardcoded-secret',
   'CWE-829': 'supply-chain',
-  'CWE-862': 'broken-authz',
+  'CWE-862': 'missing-authz',
   'CWE-863': 'broken-authz',
   'CWE-915': 'mass-assignment',
   'CWE-918': 'ssrf',

package/src/posture/fix-coverage.js

@@ -30,6 +30,7 @@ export const DECLINED_TO_FIX = Object.freeze({
   'broken-access-control': 'the correct authorisation rule is a product decision — a scanner that invents one is guessing at intent, and a wrong authz patch fails open.',
   'idor': 'same as broken-access-control: which identity may read which record is not recoverable from the code.',
   'broken-authz': 'the rule that was checked wrongly is a product decision; patching it from the code alone guesses at which roles may do what, and guessing fails open.',
+  'missing-authz': 'the rule that was checked wrongly is a product decision; patching it from the code alone guesses at which roles may do what, and guessing fails open.',
   'business-logic': 'by definition the defect is a mismatch with intent, and intent is not in the file.',
   'concurrency-bug': 'the correct lock discipline depends on the whole call graph; a local patch can deadlock rather than fix.',
   'license-graph': 'a licence conflict is resolved by a policy or a dependency decision, not by editing code.',

package/src/posture/proof-coverage.js

@@ -41,6 +41,7 @@ export const INDETERMINATE_BY_CLASS = Object.freeze({
   'idor': 'proving it means showing user A read user B\'s record, which needs two authenticated identities and a populated data store. A single-shot harness would invent both, and a PoC built on invented state proves something about the invention.',
   'broken-access-control': 'same as idor — requires two identities and real state.',
   'broken-authz': 'same as idor — requires two identities and real state.',
+  'missing-authz': 'same as idor — requires two identities and real state.',
   'ssrf': 'the proof is that the server fetched an attacker-named host. The sandbox denies egress by design, so a failed fetch is confinement talking, not the finding.',
   'xss': 'needs a browser to say whether the payload executed; a marker file cannot observe a DOM.',
   'mutation-xss': 'needs a DOM and a parser round-trip — same limit as xss.',

package/src/report/index.js

@@ -228,6 +228,18 @@ export function normalizeFindings(scan){
       dataClasses: f.dataClasses || [],
       chain: Array.isArray(f.chain) ? f.chain : null,
       sourceProvenance: f.sourceProvenance || null,
+      // Next-gen taint capability #7 (cross-service schema-driven taint):
+      // dataflow/cross-service-taint.js SETS crossService/_severityBumpReason
+      // on findings whose source crosses a declared services.yml trust
+      // boundary, but this allowlist never named either field — the same
+      // "silently dropped field" bug class engine.js's own _funcQid/callee/
+      // argIndex comments already document twice for the raw finding
+      // object, this time at the report layer. Without this, an operator
+      // reading a report saw a bumped severity with no visible reason at
+      // all: `severity` itself IS in this allowlist (so the bump survived),
+      // but its only explanation was silently discarded.
+      crossService: f.crossService || null,
+      _severityBumpReason: f._severityBumpReason || null,
       confidence: typeof f.confidence === 'number' ? f.confidence : null,
       // R17: corroboration ("one issue, many signals") — count of independent
       // analyses that agreed, and which ones.

package/src/sast/CLAUDE.md

@@ -13,7 +13,7 @@ SAST detector modules. Each file exports one or more `scan*()` functions returni
 
 ## What lives here, by category
 
-**Language-specific** — `cpp.js`, `csharp.js`, `csharp-structural.js` (regex structural: hardcoded-secret incl. split-concat + guarded SSRF — complements the flow-based `csharp.js`), `dart-flutter.js`, `go-extended.js`, `java-deserialization.js`, `java-structural.js` (regex structural SQLi/cmdi/path/SSRF via concat, with path/SSRF guards — complements the AST/flow Java modules), `kotlin.js` (Kotlin idioms + **taint-independent structural injection** detectors: SQLi/cmdi/path via string template/concat, SSRF (guarded), XXE (insecure XML config), ObjectInputStream deser — closes the corpus Kotlin FNs where a tainted-by-convention param has no in-file source), `php.js` (+ structural SQLi/cmdi via concat/`$`-interp: DB::raw/whereRaw, shell_exec/exec; structural path traversal: readfile/file_get_contents/fopen with concat), `python-sinks.js`, `ruby.js` (+ structural ActiveRecord SQLi via `#{}`/concat, backtick/system cmdi, and File/IO path traversal via interpolation/concat; **plus `scanRubyPathJoin` (PRD F1.3)** — `File.join(<root>, …, <variable>)` reaching a filesystem operation with no traversal guard, which the interpolation rule cannot reach because it requires a string LITERAL as the first component while the real advisories join variables. Refuses a constant root (`__dir__`/`Rails.root`/`Dir.pwd`), a literal last component, and a join that never reaches the filesystem; any containment guard in the window silences it, since that guard is the fix. FP budget measured at 41 findings across 3,782 real `.rb` files in 128 packages), `rust.js`, `solidity.js`, `swift.js`, `xxe.js` (CWE-611 for Java/Python **and** PHP/Go/Ruby — each non-JVM stack is XXE-safe by default, so it flags the explicit external-entity opt-in: PHP `LIBXML_NOENT`/`LIBXML_DTDLOAD`, Go `xml.Decoder` `Strict=false`/custom `Entity`, Ruby Nokogiri `noent`/`dtdload`/`replace_entities`; default-safe parses don't match).
+**Language-specific** — `cpp.js`, `csharp.js`, `csharp-cross-file.js` (SARD_80_F1 W5.31 — project-wide pass, run once after the main per-file loop like `db-taint.js`'s own `scanDbTaintCrossFile`: parses every `.cs` file, builds a project-wide class registry, and resolves a receiver-qualified call whose class lives in a DIFFERENT file by re-running `csharp.js`'s detector suite — via the newly-exported `runCSharpDetectors` — against that file with the parameter seeded as externally tainted via `csharp-analysis.js`'s `analyzeCSharpIR(ir, {externalTaintedParams})` option; only genuinely NEW findings (absent from that file's own ordinary, un-seeded scan) are reported, so nothing is ever double-counted. Single-hop, unambiguous-class/unambiguous-static-method only — the cross-file counterpart of `csharp-analysis.js`'s own same-file cross-class fix), `csharp-structural.js` (regex structural: hardcoded-secret incl. split-concat + guarded SSRF — complements the flow-based `csharp.js`), `dart-flutter.js`, `go-extended.js`, `java-deserialization.js`, `java-structural.js` (regex structural SQLi/cmdi/path/SSRF via concat, with path/SSRF guards — complements the AST/flow Java modules), `kotlin.js` (Kotlin idioms + **taint-independent structural injection** detectors: SQLi/cmdi/path via string template/concat, SSRF (guarded), XXE (insecure XML config), ObjectInputStream deser — closes the corpus Kotlin FNs where a tainted-by-convention param has no in-file source), `php.js` (+ structural SQLi/cmdi via concat/`$`-interp: DB::raw/whereRaw, shell_exec/exec; structural path traversal: readfile/file_get_contents/fopen with concat), `python-sinks.js`, `ruby.js` (+ structural ActiveRecord SQLi via `#{}`/concat, backtick/system cmdi, and File/IO path traversal via interpolation/concat; **plus `scanRubyPathJoin` (PRD F1.3)** — `File.join(<root>, …, <variable>)` reaching a filesystem operation with no traversal guard, which the interpolation rule cannot reach because it requires a string LITERAL as the first component while the real advisories join variables. Refuses a constant root (`__dir__`/`Rails.root`/`Dir.pwd`), a literal last component, and a join that never reaches the filesystem; any containment guard in the window silences it, since that guard is the fix. FP budget measured at 41 findings across 3,782 real `.rb` files in 128 packages), `rust.js` (TLS verification disabled, weak hash/cipher, weak RNG feeding a token/secret identifier, unsafe raw-memory ops (`transmute`/`from_raw_parts`/`get_unchecked`) — complements the flow-based Rust taint coverage in `dataflow/catalog.js`/`ir/parser-rust.js` for SQLi/cmdi/path/SSRF/XSS/log-injection/deserialization, which Rust gets in full since its SARD 80% F1 push addition as a first-class language), `solidity.js`, `swift.js`, `xxe.js` (CWE-611 for Java/Python **and** PHP/Go/Ruby — each non-JVM stack is XXE-safe by default, so it flags the explicit external-entity opt-in: PHP `LIBXML_NOENT`/`LIBXML_DTDLOAD`, Go `xml.Decoder` `Strict=false`/custom `Entity`, Ruby Nokogiri `noent`/`dtdload`/`replace_entities`; default-safe parses don't match).
 
 > **Structural-detector pattern (Tier 1 recall).** `kotlin.js`/`ruby.js`/`php.js` carry taint-independent rules: a dangerous sink built with string interpolation/concat is the injection shape regardless of variable names. This closes corpus FNs where a value is routed through a local var (`params[:x]` → `where("…#{x}")`) so the taint engine sees no source. Keep them high-precision: parameterized / array-form / literal variants must NOT match. Verify on the cve-replay `pre/`+`post/` pairs.