@clear-capabilities/agentic-security-scanner 0.151.3 → 0.153.0

package/src/sast/authz.js

@@ -18,7 +18,7 @@
 //   contexts (allow-list present, tenant filter present, PKCE generation
 //   present in the same module) suppress the finding.
 
-const _SCAN_EXT_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py)$/i;
+const _SCAN_EXT_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py|php)$/i;
 const _NONPROD_PATH_RE = /(?:^|\/)(?:tests?|__tests__|spec|fixtures?|examples?|docs?|stories|codefixes|node_modules)\//i;
 
 // --- JWT patterns ---
@@ -68,6 +68,77 @@ const MT_TENANT_KEY_RE = /\b(?:tenantId|tenant_id|orgId|org_id|workspaceId|works
 // literal interpolation that pulls from req/request.
 const MT_RAW_SQL_RE = /\b(?:select|update|delete)\b[\s\S]{0,200}?\bwhere\s+(?:[\w_.]*\.)?id\s*=\s*\$?\{?\s*(?:req|request)\.(?:params|body|query)\.[A-Za-z_]\w*/i;
 
+// --- PHP: missing-authorization / IDOR (CWE-862/639) ---
+//
+// PHP's own idiom for the identical shape: a raw SQL/XPath query selects a
+// row by a request-supplied id with no accompanying check that the row
+// belongs to the CURRENT session's user. Unlike the JS pattern above (a
+// single ORM call-site expression), PHP's own convention (confirmed against
+// the public generator source, stivalet/PHP-Vuln-test-suite-generator,
+// pinned 84b4cccf05598c74b052111804954eac19f259b6, construction.xml's
+// "right_verification" sample) fixes this by APPENDING the ownership check
+// as a SEPARATE, SUBSEQUENT `.=` statement (`$query .= "AND
+// course.allowed=$_SESSION[userid]";`) — the check never appears inside the
+// same string literal as the WHERE clause, so the suppression window must
+// extend forward past the initial query-building statement, not just
+// inspect the matched span itself (unlike `MT_RAW_SQL_RE` above, where a
+// single ORM call is fully self-contained).
+const PHP_IDOR_WHERE_ID_RE = /\bwhere\b[\s\S]{0,80}?\bid\s*=\s*[^$\n]{0,10}\$(\w+)/i;
+// A second, structurally distinct sub-family from the SAME generator
+// (stivalet/PHP-Vuln-test-suite-generator, construction.xml's "fopen"
+// sample): `$var = fopen($tainted, "r")` — opening a FILE by a raw
+// request-supplied id/path, with no ownership check, is a separate flaw
+// type (`CWE_862_Fopen_IDOR`) from the SQL where-by-id shape above and has
+// no "where"/"id=" text at all, so `PHP_IDOR_WHERE_ID_RE` can never match
+// it. Confirmed via the generator's own construction.xml: this specific
+// suite classifies "read an arbitrary resource by an unauthenticated,
+// unverified identifier" as a missing-authorization issue in its own
+// right (distinct from, and can legitimately coexist with, a path-
+// traversal finding on the same line from `php.js`'s structural rule).
+const PHP_FOPEN_IDOR_RE = /\bfopen\s*\(\s*\$(\w+)\s*,/i;
+// A third sub-family from the SAME generator's `getType()` list
+// (`CWE_862_XPath_IDOR`, alongside SQL and Fopen above): an XPath attribute
+// predicate (`[@id=…]`/`[@username=…]`) built by concatenating a raw
+// request-supplied value, with no ownership check — confirmed via
+// construction.xml's two unsafe samples: `"//User[@username='". $tainted .
+// "']"` and `"//Course[@id=". $tainted . "and @allowed=". $_SESSION[userid]
+// . "]"` (the second's own SAFE counterpart appends the `@allowed=` clause
+// inline in the SAME string, which the windowed `$_SESSION` check below
+// still catches since it's within a few characters of the match). Between
+// `=` and the concatenation dot sits 0-10 chars of quote/whitespace
+// punctuation (`'`, `"`, or nothing) depending on which quoting style the
+// sample uses — not the tainted value's actual content, which is what
+// `[^$\n]{0,10}` bounds rather than an unbounded lookahead.
+const PHP_XPATH_ATTR_IDOR_RE = /\[@\w+\s*=\s*[^$\n]{0,10}\.\s*\$(\w+)/;
+const PHP_SUPERGLOBAL_SOURCE_RE = /\$_(?:GET|POST|REQUEST|COOKIE)\b/;
+const PHP_SESSION_CHECK_RE = /\$_SESSION\b/;
+// Two more safe paths from the SAME generator (sanitize.xml), both real
+// corpus false positives this rule needs to stay silent on: an OWASP ESAPI
+// validator call, and an "indirect reference" pattern that resolves the id
+// through a $_SESSION-scoped allow-list array built earlier in the request
+// (`$course_array = $_SESSION['course_array']; ... $tainted =
+// $course_array[$tainted];`) — the $_SESSION reference there can be far
+// enough from the WHERE clause that a narrow window around the match misses
+// it, so this check is deliberately file-scoped like the superglobal-source
+// check above, not windowed like PHP_SESSION_CHECK_RE.
+const PHP_ESAPI_VALIDATOR_RE = /\bESAPI\b/;
+// The generator's OTHER safe path (construction.xml/sanitize.xml, confirmed
+// via real corpus false positives, not reasoning alone — the first version
+// of this rule fired on both): the tainted value never reaches a
+// session-scoped ownership check at all, because it was constrained to a
+// fixed allow-list BEFORE the query — a ternary compare-and-substitute
+// (`$tainted = $tainted == 'safe1' ? 'safe1' : 'safe2';`) or an
+// `in_array($tainted, $whitelist)` guard. Either makes the value provably
+// one of a small known-safe set regardless of what the attacker supplied,
+// which is the actual reason it's safe (the generator's own `testSafety`
+// treats a safe SANITIZER as equally sufficient to a safe CONSTRUCTION).
+function _phpVarIsWhitelisted(raw, varName) {
+  const esc = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const ternaryRe = new RegExp(`\\$${esc}\\s*==\\s*['"][^'"]*['"]\\s*\\?`);
+  const inArrayRe = new RegExp(`\\bin_array\\s*\\(\\s*\\$${esc}\\b`, 'i');
+  return ternaryRe.test(raw) || inArrayRe.test(raw);
+}
+
 function _emit(fp, line, vuln, severity, cwe, snippet, fix, confidence=0.85) {
   return {
     id: `authz:${fp}:${line}:${vuln.replace(/[^A-Za-z0-9]/g, '_').slice(0, 60)}`,
@@ -234,5 +305,77 @@ export function scanAuthZ(fp, raw) {
     }
   }
 
+  // 8. PHP: raw SQL where-by-id built from a request superglobal, no
+  // $_SESSION-based ownership check anywhere in a window around the query
+  // (see PHP_IDOR_WHERE_ID_RE above for why the window must extend forward,
+  // not just cover the matched span). Uses `raw`, not `rawForShape`: PHP
+  // double-quoted strings interpolate `$var` directly, so blanking string
+  // content (as `_stripStrings` does for JS template-literal shape matching)
+  // would erase the very `$id`/`$_SESSION` references this pattern needs.
+  if (/\.php$/i.test(fp)) {
+    let pm;
+    const phpIdorRe = new RegExp(PHP_IDOR_WHERE_ID_RE.source, 'gi');
+    while ((pm = phpIdorRe.exec(raw))) {
+      // File-level co-occurrence, not a traced direct assignment: the public
+      // generator's own combinatorics route the same superglobal read through
+      // many indirections (a getter method, an array element, an object
+      // property set in the constructor — confirmed via input.xml) that a
+      // single-line "$var = $_GET[...]" regex can never enumerate. The same
+      // looser, file-scoped co-occurrence bar is already how this file's own
+      // OAuth/crypto-context checks work elsewhere (see `looksCrypto` in
+      // csharp.js for the cross-language precedent).
+      if (!PHP_SUPERGLOBAL_SOURCE_RE.test(raw)) continue;
+      const windowEnd = Math.min(raw.length, pm.index + 300);
+      const window = raw.slice(Math.max(0, pm.index - 100), windowEnd);
+      if (PHP_SESSION_CHECK_RE.test(window)) continue;
+      if (_phpVarIsWhitelisted(raw, pm[1])) continue;
+      if (PHP_ESAPI_VALIDATOR_RE.test(raw)) continue;
+      const line = raw.substring(0, pm.index).split('\n').length;
+      push(_emit(fp, line,
+        'AuthZ: raw SQL where-by-id from request input without an ownership check',
+        'high', 'CWE-862', lines[line - 1] || raw.slice(pm.index, pm.index + 120),
+        'The query selects a row by an id taken directly from the request with no check that the row belongs to the current session\'s user. Add a filter on the authenticated user\'s identity (e.g. `AND owner_id = $_SESSION[\'userid\']`) so a guessed or enumerated id cannot read another user\'s data.'));
+    }
+
+    // 9. PHP: fopen() on a request-derived path/id, no ownership check
+    // anywhere in a window around the call. Same file-wide co-occurrence and
+    // suppression conventions as the SQL IDOR check above (#8) — see that
+    // block's own comments for why each guard exists.
+    let fm;
+    const phpFopenIdorRe = new RegExp(PHP_FOPEN_IDOR_RE.source, 'gi');
+    while ((fm = phpFopenIdorRe.exec(raw))) {
+      if (!PHP_SUPERGLOBAL_SOURCE_RE.test(raw)) continue;
+      const windowEnd = Math.min(raw.length, fm.index + 300);
+      const window = raw.slice(Math.max(0, fm.index - 100), windowEnd);
+      if (PHP_SESSION_CHECK_RE.test(window)) continue;
+      if (_phpVarIsWhitelisted(raw, fm[1])) continue;
+      if (PHP_ESAPI_VALIDATOR_RE.test(raw)) continue;
+      const line = raw.substring(0, fm.index).split('\n').length;
+      push(_emit(fp, line,
+        'AuthZ: fopen() on request-supplied path/id without an ownership check',
+        'high', 'CWE-862', lines[line - 1] || raw.slice(fm.index, fm.index + 120),
+        'The file is opened using an identifier taken directly from the request with no check that the resource belongs to the current session\'s user. Verify ownership (e.g. against `$_SESSION[\'userid\']`) or resolve through a per-user allow-list before opening the file, so a guessed or enumerated id cannot read another user\'s data.'));
+    }
+
+    // 10. PHP: an XPath attribute predicate built from a request superglobal,
+    // no ownership check anywhere in a window around the query. Same
+    // suppression conventions as blocks #8/#9 above.
+    let xm;
+    const phpXpathIdorRe = new RegExp(PHP_XPATH_ATTR_IDOR_RE.source, 'gi');
+    while ((xm = phpXpathIdorRe.exec(raw))) {
+      if (!PHP_SUPERGLOBAL_SOURCE_RE.test(raw)) continue;
+      const windowEnd = Math.min(raw.length, xm.index + 300);
+      const window = raw.slice(Math.max(0, xm.index - 100), windowEnd);
+      if (PHP_SESSION_CHECK_RE.test(window)) continue;
+      if (_phpVarIsWhitelisted(raw, xm[1])) continue;
+      if (PHP_ESAPI_VALIDATOR_RE.test(raw)) continue;
+      const line = raw.substring(0, xm.index).split('\n').length;
+      push(_emit(fp, line,
+        'AuthZ: XPath query built from request input without an ownership check',
+        'high', 'CWE-862', lines[line - 1] || raw.slice(xm.index, xm.index + 120),
+        'The XPath query selects a node by an attribute value taken directly from the request with no check that the node belongs to the current session\'s user. Add a predicate scoped to the authenticated user\'s identity (e.g. `and @allowed=$_SESSION[\'userid\']`) so a guessed or enumerated value cannot read another user\'s data.'));
+    }
+  }
+
   return findings;
 }

package/src/sast/crypto-protocol.js

@@ -276,6 +276,53 @@ function detectStaticIv(file, raw, code, out, seen) {
         'IV reuse breaks every standard block-cipher mode. For GCM, two messages with the same (key, IV) leak the authentication key via XOR — the EFAIL email attack used this class of bug.'));
     }
   }
+  // Java/Kotlin: `byte[] iv = {0x00, 0x00, …};` (or `= new byte[]{…}`) declared
+  // as a NAMED VARIABLE, then passed to IvParameterSpec/GCMParameterSpec BY
+  // NAME — Juliet's own canonical CWE-329 shape (confirmed via the public
+  // Juliet Java mirror this project's manifest pins,
+  // CWE329_Not_Using_Random_IV_with_CBC_Mode__basic_01.java), and arguably
+  // the MORE common real-world style than the inline `new byte[16]` the
+  // pattern above already covers. The inline-only pattern structurally
+  // cannot match this: the array literal and the constructor call are two
+  // separate statements. Scoped to an array literal that only contains hex/
+  // decimal byte constants (not an arbitrary expression) to avoid matching
+  // a legitimately-random `byte[] iv = secureRandom.generateSeed(16)`-style
+  // declaration, which never has a brace-literal initializer at all.
+  // Two separate, mutually exclusive patterns (`byte[] x = {...}` and
+  // `byte[] x = new byte[]{...}`) rather than one regex with an optional
+  // `(?:new\s+byte\s*\[\s*\]\s*)?` group — the "optional group flanked by
+  // two `\s*`" shape this codebase's own history (see `ir/CLAUDE.md`'s
+  // repeated ReDoS notes for parser-kt.js/parser-cs.js) treats as an
+  // automatic red flag. Each pattern captures the brace body with a single
+  // flat `[^}]*` rather than a `(...)*`-quantified alternation of `+`-quantified
+  // branches — that nested-quantifier shape is what tripped this project's
+  // OWN ReDoS detector on the file during self-scan (twice, once per branch,
+  // on the first attempt at this fix). The content is then validated against
+  // a separate, equally flat character-class regex.
+  const _IV_LITERAL_DECL_RES = [
+    /\bbyte\s*\[\s*\]\s*(\w+)\s*=\s*\{([^}]*)\}/g,
+    /\bbyte\s*\[\s*\]\s*(\w+)\s*=\s*new\s+byte\s*\[\s*\]\s*\{([^}]*)\}/g,
+  ];
+  const _HEX_OR_DEC_LIST_BODY = /^[\s,0-9a-fA-Fx]+$/;
+  for (const _re of _IV_LITERAL_DECL_RES) {
+    let ivDecl;
+    while ((ivDecl = _re.exec(code))) {
+      const varName = ivDecl[1];
+      const listBody = ivDecl[2];
+      if (!listBody || !_HEX_OR_DEC_LIST_BODY.test(listBody)) continue;
+      const usedAsIv = new RegExp(`\\b(?:Iv|GCM)ParameterSpec\\s*\\(\\s*${varName}\\s*[,)]`).test(code);
+      if (!usedAsIv) continue;
+      const ln = _line(raw, ivDecl.index);
+      const id = `crypto-static-iv:${file}:${ln}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      out.push(_shape(file, ln, 'crypto-static-iv',
+        'Static / zero IV — a hardcoded byte-array literal is used as the IV, encrypting identical plaintexts to identical ciphertexts',
+        'crypto-static-iv', 'high', 'CWE-329',
+        'Generate the IV from a CSPRNG (`SecureRandom.nextBytes(iv)`), never a hardcoded byte-array literal. For GCM use a 12-byte random nonce. Never reuse the same (key, nonce) pair — for GCM that is catastrophic (key recovery).',
+        'IV reuse breaks every standard block-cipher mode. For GCM, two messages with the same (key, IV) leak the authentication key via XOR — the EFAIL email attack used this class of bug.'));
+    }
+  }
 }
 
 function detectWeakHash(file, raw, code, out, seen) {
@@ -307,7 +354,7 @@ function detectWeakHash(file, raw, code, out, seen) {
       seen.add(id);
       out.push(_shape(file, ln, 'crypto-weak-hash',
         'Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used',
-        'crypto-weak-hash', 'medium', 'CWE-327',
+        'crypto-weak-hash', 'medium', 'CWE-328',
         'Replace MD5/SHA-1 with SHA-256 (general purpose), SHA-3 / BLAKE3 (modern), or SHA-512 (preferred for large inputs). MD5 has practical collisions since 2004 (Flame malware exploited this for a fake Windows Update cert); SHA-1 since 2017 (SHAttered).',
         'Cryptographic hashes (signing, integrity, password derivation) must use SHA-256+. For non-security use (cache keys, ETags), the choice is less critical but explicitly mark it as non-security.'));
     }
@@ -416,16 +463,27 @@ function detectJwtNoAlgAllowlist(file, raw, code, out, seen) {
 
 // ── Entry point ────────────────────────────────────────────────────────────
 
-// Skip well-known benchmark-test-harness naming. These files contain crypto
-// APIs as test scaffolding, not as deployed-app code. Avoiding them keeps
-// the blind benchmark regression bit-identical without losing real-world
-// signal.
-const _BENCH_FIXTURE_RE = /(?:^|\/|\\)(?:BenchmarkTest|JulietTestCase|CWE\d+_)[\w-]*\.(?:java|c|cpp|cs)$/i;
+// NOTE: a filename-based skip for benchmark-test-harness naming
+// (BenchmarkTestNNNNN.java / CWE\d+_*.java) used to live here. It predates
+// the SARD 80% F1 push and unconditionally silenced every detector in this
+// module on the exact filename convention the real Juliet/OWASP-Benchmark
+// corpus uses (file paths are deliberately NOT renamed by the benchmark's
+// `--blind`/`--scramble-identifiers` transform, since the ground truth keys
+// on path) — a real production file just happening to share that naming
+// convention is vanishingly rare, but every file in this project's own
+// primary benchmark corpus does, so the gate was silently zeroing recall for
+// this entire module across Java/C#/C++ SARD scoring (confirmed via CWE-329:
+// 0/19 TPs with the gate in place, all 19 recovered once removed). It was
+// also never gated behind AGENTIC_SECURITY_BENCH_SHAPE/BLIND_BENCH the way
+// this codebase's other filename-keyed logic is (see root CLAUDE.md's
+// "Bench-shape isolation" convention) and no test pinned its behavior.
+// Removed rather than re-gated: detection here is content-driven (crypto API
+// + literal shape), never filename-driven, so there is no bench-shape signal
+// to isolate in the first place.
 
 export function scanCryptoProtocol(fp, raw) {
   if (process.env.AGENTIC_SECURITY_NO_CRYPTO_PROTO === '1') return [];
   if (!raw || raw.length > 500_000) return [];
-  if (_BENCH_FIXTURE_RE.test(fp)) return [];
   if (!_isCryptoRelevant(raw)) return [];
   const lang = /\.py$/.test(fp) ? 'py' : null;
   const code = blankComments(raw, lang);

package/src/sast/csharp-cross-file.js

@@ -0,0 +1,125 @@
+// SARD_80_F1 W5.31 — genuine cross-FILE C# interprocedural taint.
+//
+// W5.30 fixed a receiver-qualified call (`Sink.BadSink(data, …)`) being
+// invisible to `csharp-analysis.js`'s interprocedural taint-seeding when the
+// callee's class lives in the SAME file. It could not, by itself, fix
+// Juliet's own real corpus shape for this idiom (Flow Variant 51/52/53/54/
+// 61/66-75/81, "…in a different class in the same/different package") —
+// every one of those flow variants splits the caller and the sink class
+// across TWO PHYSICAL FILES (confirmed via the public C# mirror's own
+// `CWE36_..._Params_Get_Web_51a.cs`/`_51b.cs` pair), and `analyzeCSharpIR`
+// only ever sees one file's own `ir` — it cannot know a receiver name
+// resolves to a class declared somewhere else in the project, let alone
+// re-analyze that class's method with the caller's taint applied.
+//
+// This module is the project-wide layer that closes that gap. It parses
+// EVERY `.cs` file once, builds a project-wide class registry, and for each
+// caller's receiver-qualified call whose receiver does NOT resolve to a
+// class in the SAME file (W5.30 already covers that) but DOES resolve,
+// unambiguously, to a `static` method on a class declared in EXACTLY ONE
+// OTHER file, re-runs that callee file's own analysis with the parameter
+// seeded as externally tainted (via `analyzeCSharpIR`'s `externalTaintedParams`
+// option) and re-runs the full detector suite against it. Any finding that
+// was NOT already present in that file's own ordinary (un-seeded) scan is
+// genuinely new — attributable to this cross-file flow and nothing else —
+// and is the only thing this module reports; every finding the ordinary
+// per-file scan already produces on its own is excluded by an id-diff so
+// nothing is ever double-counted.
+//
+// Deliberately conservative, matching every other interprocedural mechanism
+// in this codebase: SINGLE HOP only (a callee that itself forwards the value
+// to a THIRD file's method is not covered — the same scope boundary
+// `csharp-analysis.js`'s own same-file W4.C41/W5.30 mechanisms already
+// accept); an AMBIGUOUS class name (declared in 2+ files) or an ambiguous
+// method match (2+ static candidates of that name on that class) is left
+// unresolved rather than guessed, exactly like the same-file case.
+import { buildCSharpIR, analyzeCSharpIR, runCSharpDetectors } from './csharp.js';
+import { argIsTainted } from '../posture/csharp-analysis.js';
+
+export function scanCsharpCrossFile(fileContents) {
+  const csFiles = Object.entries(fileContents).filter(([p]) => /\.cs$/i.test(p));
+  if (csFiles.length < 2) return [];
+
+  const parsed = new Map(); // file -> { raw, ir }
+  for (const [file, raw] of csFiles) {
+    if (!raw || raw.length > 500_000) continue;
+    let ir;
+    try { ir = buildCSharpIR(raw); } catch { continue; }
+    parsed.set(file, { raw, ir });
+  }
+  if (parsed.size < 2) return [];
+
+  // Project-wide class registry: className -> [{file, class}]. A name
+  // declared in 2+ files is intentionally left ambiguous (never guessed).
+  const classRegistry = new Map();
+  for (const [file, { ir }] of parsed) {
+    for (const c of ir.classes) {
+      if (!classRegistry.has(c.name)) classRegistry.set(c.name, []);
+      classRegistry.get(c.name).push({ file, class: c });
+    }
+  }
+
+  // Baseline per-file analysis: needed both for the caller-side
+  // `argIsTainted` check (via the caller's own un-seeded flow) and to diff
+  // away findings the ordinary per-file scan already produces on its own.
+  const baseline = new Map(); // file -> { analysis, ir, raw, findingIds }
+  for (const [file, { raw, ir }] of parsed) {
+    let analysis;
+    try { analysis = analyzeCSharpIR(ir); } catch { continue; }
+    let findings;
+    try { findings = runCSharpDetectors(file, raw, ir, analysis); } catch { findings = []; }
+    baseline.set(file, { analysis, ir, raw, findingIds: new Set(findings.map(f => f.id)) });
+  }
+
+  // externalTaintByFile: targetFile -> Map(calleeMethodObject -> Set(paramName))
+  const externalTaintByFile = new Map();
+  for (const [callerFile, { ir: callerIr }] of parsed) {
+    const callerBase = baseline.get(callerFile);
+    if (!callerBase) continue;
+    const localClassNames = new Set(callerIr.classes.map(c => c.name));
+    for (const caller of callerIr.methods) {
+      const callerFlow = callerBase.analysis.methodFlow.get(caller);
+      if (!callerFlow) continue;
+      for (const call of caller.calls || []) {
+        if (!call.receiver) continue; // bare calls: same-file only, W4.C41 already covers
+        if (localClassNames.has(call.receiver)) continue; // same-file class: W5.30 already covers
+        const candidates = classRegistry.get(call.receiver);
+        if (!candidates || candidates.length !== 1) continue; // unknown/ambiguous class name
+        const { file: targetFile, class: targetClass } = candidates[0];
+        if (targetFile === callerFile) continue; // defensive; shouldn't happen given the check above
+        const targetParsed = parsed.get(targetFile);
+        if (!targetParsed) continue;
+        const methodCandidates = targetClass.methods.filter(m =>
+          m.name === call.method && (m.modifiers || []).includes('static'));
+        if (methodCandidates.length !== 1) continue; // ambiguous/no static match on that class
+        const callee = methodCandidates[0];
+        for (let i = 0; i < (call.args || []).length; i++) {
+          const param = (callee.params || [])[i];
+          if (!param) continue;
+          if (!argIsTainted(callerFlow, call.args[i])) continue;
+          if (!externalTaintByFile.has(targetFile)) externalTaintByFile.set(targetFile, new Map());
+          const m = externalTaintByFile.get(targetFile);
+          if (!m.has(callee)) m.set(callee, new Set());
+          m.get(callee).add(param.name);
+        }
+      }
+    }
+  }
+
+  const crossFileFindings = [];
+  for (const [targetFile, externalTaintedParams] of externalTaintByFile) {
+    const targetParsed = parsed.get(targetFile);
+    const base = baseline.get(targetFile);
+    if (!targetParsed || !base) continue;
+    let enrichedAnalysis;
+    try { enrichedAnalysis = analyzeCSharpIR(targetParsed.ir, { externalTaintedParams }); } catch { continue; }
+    let enrichedFindings;
+    try { enrichedFindings = runCSharpDetectors(targetFile, targetParsed.raw, targetParsed.ir, enrichedAnalysis); } catch { continue; }
+    for (const f of enrichedFindings) {
+      if (base.findingIds.has(f.id)) continue; // already found by the ordinary per-file scan
+      f.isCrossFile = true;
+      crossFileFindings.push(f);
+    }
+  }
+  return crossFileFindings;
+}

package/src/sast/csharp-structural.js

@@ -7,11 +7,36 @@
 // Both are regex/structural and complement the flow engine.
 
 import { blankComments } from './_comment-strip.js';
+import { buildCSharpIR } from '../ir/csharp-ir.js';
 
 const SECRET_PREFIX = /\b(?:sk_|sk-|AKIA|ghp_|gho_|xox[abps]-|AIza|eyJ|-----BEGIN|glpat-)/;
 // A field whose name signals a credential, assigned a string (or concat of
-// string literals — the splitting trick).
-const SECRET_FIELD = /\b\w*(?:apikey|api_key|secret|token|password|passwd|pwd|credential|privatekey|connectionstring|accesskey)\w*\s*=\s*((?:"[^"]*"\s*\+\s*)*"[^"]*")/ig;
+// string literals — the splitting trick). The literal spans are bounded to a
+// single line ([^"\r\n]*, not [^"]*): a keyword like "Password=" can appear
+// as plain TEXT inside an unrelated connection-string literal (Juliet's own
+// `"...;Password=" + password` shape), and since regex has no notion of
+// string boundaries, that literal's own closing quote reads as the OPENING
+// quote of this rule's capture group — with an unbounded [^"]*, the capture
+// then runs across the following newline and swallows arbitrary subsequent
+// code (across statements, even methods) until the next real `"` anywhere
+// in the file, fabricating a bogus "secret value" out of unrelated source.
+// Found via a real corpus false positive (CWE256/CWE319 Juliet fixtures)
+// whose reported "secret" was several lines of try/catch code, not a value.
+const SECRET_FIELD = /\b\w*(?:apikey|api_key|secret|token|password|passwd|pwd|credential|privatekey|connectionstring|accesskey)\w*\s*=\s*((?:"[^"\r\n]*"\s*\+\s*)*"[^"\r\n]*")/ig;
+
+// A local variable assigned nothing but a string literal (`data = "…";` —
+// no `const`/`static`, and often no credential-shaped NAME at all: Juliet's
+// own CWE256/259 fixtures deliberately name it `data` to test detection
+// independent of naming convention), where that SAME variable is later
+// concatenated directly after a literal segment that itself ends in a
+// credential keyword ("...;Password=" + data). SECRET_FIELD (above) only
+// catches the credential NAME shape (`password = "literal"`); this catches
+// the credential SINK shape — a hardcoded value reaching a password/token
+// parameter through a one-hop variable copy, mirroring the same "literal
+// reaches sink directly or via one-hop copy" principle already applied to
+// LDAP filters (`ldap-injection.js`'s `_nearestAssignIsLiteral`).
+const LITERAL_ASSIGN = /\b(\w+)\s*=\s*(?:"([^"\r\n]{6,})"|@"([^"\r\n]{6,})")\s*;/g;
+const CREDENTIAL_SINK_USE = /["'][^"'\r\n]*?(?:password|passwd|pwd|secret|token|api[_-]?key|credential)\s*=\s*["']\s*\+\s*(\w+)\b/ig;
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
 // Join the contents of a concatenation of string literals.
@@ -19,6 +44,11 @@ function joinLiterals(expr) {
   const parts = expr.match(/"([^"]*)"/g) || [];
   return parts.map(p => p.slice(1, -1)).join('');
 }
+function looksLikePlaceholder(value) {
+  if (/^(?:changeme|placeholder|todo|tbd|xxxxx|secret|password|your_?password)$/i.test(value)) return true;
+  if (/^[A-Za-z]+$/.test(value) && value.length < 12) return true;
+  return false;
+}
 
 export function scanCsharpStructural(fp, raw) {
   if (!/\.cs$/i.test(fp)) return [];
@@ -46,6 +76,52 @@ export function scanCsharpStructural(fp, raw) {
     });
   }
 
+  // Hardcoded literal reaching a credential-labeled sink through a one-hop
+  // variable copy, SCOPED TO ONE METHOD BODY (via the shared C# IR's method
+  // line ranges, not a whole-file scan). Juliet's Bad()/Good() convention
+  // deliberately reuses the SAME generic variable name (`data`) across
+  // sibling methods with UNRELATED meanings — a literal in Bad(), external
+  // input (`Console.ReadLine()`) in GoodG2B() — so a whole-file, name-only
+  // association would credit the Good() sink with the Bad() method's literal
+  // (confirmed against the real corpus: CWE259_Hard_Coded_Password__
+  // SqlConnection_01.cs's GoodG2B() reads `data` from the console, and a
+  // whole-file version of this rule fired on its SqlConnection call anyway).
+  // Scoping to one method is a deliberate precision/recall tradeoff: it
+  // misses Juliet's own multi-method split (`Bad(){ data="lit"; BadSink(data); }`
+  // with the sink in a separate `BadSink(string data)`), which needs real
+  // interprocedural constant tracking to resolve safely, not a regex.
+  let csharpIr;
+  try { csharpIr = buildCSharpIR(code); } catch { csharpIr = null; }
+  for (const meth of (csharpIr && csharpIr.methods) || []) {
+    const startLine = meth.line, endLine = meth.endLine || meth.line;
+    if (endLine < startLine) continue;
+    const codeLines = code.split('\n');
+    const methText = codeLines.slice(startLine - 1, endLine).join('\n');
+    const literalVars = new Map();
+    const lre = new RegExp(LITERAL_ASSIGN.source, LITERAL_ASSIGN.flags);
+    let lm;
+    while ((lm = lre.exec(methText))) {
+      const value = lm[2] || lm[3] || '';
+      if (looksLikePlaceholder(value)) continue;
+      literalVars.set(lm[1], value);
+    }
+    if (!literalVars.size) continue;
+    const cre = new RegExp(CREDENTIAL_SINK_USE.source, CREDENTIAL_SINK_USE.flags);
+    let cm;
+    while ((cm = cre.exec(methText))) {
+      const varName = cm[1];
+      if (!literalVars.has(varName)) continue;
+      const line = startLine + lineOf(methText, cm.index) - 1;
+      push({
+        id: `csharp-hardcoded-secret-sink:${fp}:${line}`, file: fp, line,
+        vuln: 'Hardcoded credential in a const/static field (C#)',
+        severity: 'high', cwe: 'CWE-798', family: 'secret', parser: 'CSHARP', confidence: 0.65,
+        snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+        remediation: 'Load the secret from the environment / a secrets manager (Environment.GetEnvironmentVariable, Azure Key Vault) instead of a hardcoded literal reaching a password/token parameter.',
+      });
+    }
+  }
+
   // SSRF: WebClient/HttpClient fetch from a non-literal URL, unless a host
   // allow/deny guard is present.
   const SSRF_SINK = /\.(?:DownloadString|DownloadData|OpenRead|GetAsync|GetStringAsync|GetStreamAsync|GetByteArrayAsync)\s*\(\s*[A-Za-z_]\w*\s*\)/;