@clear-capabilities/agentic-security-scanner 0.84.1 → 0.118.2

package/src/sast/stored-taint.js

@@ -0,0 +1,88 @@
+// Stored / second-order taint (roadmap #2) — OPT-IN.
+//
+// Classic SAST blind spot: data written to a persistence store (DB / cache /
+// file) by one request and read back by another is implicitly trusted, but if
+// any user input was ever stored there it is still attacker-controlled. The
+// result is stored XSS, second-order SQLi, etc. The engine's forward taint
+// can't see across the persistence boundary.
+//
+// This detector flags the second-order SHAPE: a value READ from a store that
+// flows into an injection sink without re-validation. It is inherently lower
+// confidence than first-order taint (stored data is not ALWAYS attacker-
+// controlled), so it is OFF by default and enabled with:
+//
+//   AGENTIC_SECURITY_STORED_TAINT=1
+//
+// Being opt-in, it cannot change default scan behavior (no default FPs/FNs).
+
+import { blankComments } from './_comment-strip.js';
+
+const JS_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const PY_RE = /\.py$/i;
+
+// A read from a persistence store, capturing the assigned variable.
+//   const row = await db.query(...)   |   row = collection.find_one(...)
+const READ_ASSIGN = [
+  /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?[\w$.]*\b(?:query|find|findOne|findById|findAll|fetchRow|fetchAll|getItem|get|scan|select|aggregate|exec)\s*\(/g,
+  /\b([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?[\w$.]*\b(?:query|find|find_one|fetchone|fetchall|first|all|get_object_or_404)\s*\(/g,
+];
+
+// Injection sinks that, fed stored data, are second-order vulnerabilities.
+function sinkPatternsFor(varName) {
+  const v = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return [
+    [new RegExp(`\\b(?:eval|exec|execSync|Function)\\s*\\([^)]*\\b${v}\\b`), 'CWE-94', 'code-injection'],
+    [new RegExp(`\\.(?:innerHTML|outerHTML)\\s*=\\s*[^;\\n]*\\b${v}\\b`), 'CWE-79', 'xss'],
+    [new RegExp(`\\bres(?:ponse)?\\s*\\.\\s*(?:send|write|end)\\s*\\([^)]*\\b${v}\\b`), 'CWE-79', 'xss'],
+    [new RegExp(`\\b(?:query|execute|raw)\\s*\\([^)]*\\b${v}\\b[^)]*\\+`), 'CWE-89', 'sql-injection'],
+    [new RegExp(`\\b(?:exec|execSync|spawn|system|popen)\\s*\\([^)]*\\b${v}\\b`), 'CWE-78', 'command-injection'],
+  ];
+}
+
+const REVALIDATED = /\b(?:validate|sanitize|escape|encode|allow(?:list|ed)|schema\.\w*parse)\b/i;
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+export function scanStoredTaint(fp, raw) {
+  if (process.env.AGENTIC_SECURITY_STORED_TAINT !== '1') return [];
+  if (!raw || raw.length > 500_000) return [];
+  if (!JS_RE.test(fp) && !PY_RE.test(fp)) return [];
+
+  const code = blankComments(raw, PY_RE.test(fp) ? 'py' : undefined);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  for (const re of READ_ASSIGN) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code))) {
+      const varName = m[1];
+      if (!varName) continue;
+      const readLine = lineOf(code, m.index);
+      // Search a forward window for the var reaching a sink, with no
+      // re-validation in between.
+      const winEnd = Math.min(lines.length, readLine + 20);
+      const window = lines.slice(readLine, winEnd).join('\n');
+      if (REVALIDATED.test(window)) continue;
+      for (const [sinkRe, cwe, family] of sinkPatternsFor(varName)) {
+        const sm = sinkRe.exec(window);
+        if (!sm) continue;
+        const sinkLine = readLine + window.substring(0, sm.index).split('\n').length;
+        const key = `${sinkLine}:${family}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        findings.push({
+          id: `stored-taint:${fp}:${sinkLine}:${family}`,
+          severity: 'medium', file: fp, line: sinkLine,
+          vuln: `Second-order / stored taint candidate (${family})`,
+          cwe, family, parser: 'SAST', confidence: 0.4,
+          description: `A value read from a persistence store ('${varName}') flows into a ${family} sink without re-validation. If any user input is ever written to that store, this is a second-order injection (e.g. stored XSS / second-order SQLi).`,
+          remediation: 'Treat data read from a store as untrusted: validate/encode it at the sink exactly as you would direct request input. Do not rely on validation performed at write time.',
+        });
+        break; // one sink class per read is enough
+      }
+    }
+  }
+  return findings;
+}

package/src/sast/tree-sitter-sinks.js

@@ -0,0 +1,62 @@
+// Tree-sitter-backed sinks for long-tail languages (roadmap #8).
+//
+// First AST-accurate detector for a language that has no first-class IR parser.
+// Gated behind AGENTIC_SECURITY_TREE_SITTER=1 and the optional tree-sitter
+// dependency; when either is absent it degrades to a no-op (the existing
+// pattern detectors still run). Anchoring on real AST nodes (not regex over
+// raw text) means comments and string literals can't produce false matches.
+//
+// Rust shell-spawn command injection: a `std::process::Command` that launches a
+// shell (sh/bash/cmd/powershell) with -c / -Command AND a non-literal argument.
+// That is the classic "build a shell string from input" injection; spawning a
+// program directly (no shell) is not flagged.
+
+import { getParserFor, treeSitterLangOf, walkNamed } from '../ir/tree-sitter-loader.js';
+
+const SHELL_PROG = /Command::new\s*\(\s*[bB]?"(?:sh|bash|zsh|dash|ksh|cmd(?:\.exe)?|powershell(?:\.exe)?)"/;
+const SHELL_FLAG = /\.args?\s*\(\s*\[?\s*[bB]?"(?:-c|\/c|\/C|-Command)"/;
+// An .arg()/.args() whose argument does NOT start with a string literal → dynamic.
+const DYNAMIC_ARG = /\.args?\s*\(\s*(?![bB]?["[])[A-Za-z_&*([]/;
+
+export async function scanTreeSitterRust(fp, raw) {
+  if (process.env.AGENTIC_SECURITY_TREE_SITTER !== '1') return [];
+  if (treeSitterLangOf(fp) !== 'rust') return [];
+  if (!raw || raw.length > 500_000) return [];
+  if (!/Command::new/.test(raw)) return [];           // cheap pre-filter
+
+  const parser = await getParserFor('rust');
+  if (!parser) return [];                              // optional dep absent → degrade
+  let tree;
+  try { tree = parser.parse(raw); } catch { return []; }
+
+  const findings = [];
+  const seen = new Set();
+  walkNamed(tree.rootNode, (n) => {
+    if (n.type !== 'call_expression') return;
+    const text = n.text;
+    if (!SHELL_PROG.test(text) || !SHELL_FLAG.test(text) || !DYNAMIC_ARG.test(text)) return;
+    const line = n.startPosition.row + 1;
+    if (seen.has(line)) return;
+    seen.add(line);
+    findings.push({
+      id: `ts-rust-cmdi:${fp}:${line}`,
+      severity: 'high', file: fp, line,
+      vuln: 'Command injection (Rust shell spawn with dynamic argument)',
+      cwe: 'CWE-78', family: 'command-injection', parser: 'TREE-SITTER', confidence: 0.55,
+      description: 'A std::process::Command spawns a shell (sh/bash/cmd/powershell) with -c/-Command and a non-literal argument. If that argument is attacker-influenced this is command injection.',
+      remediation: 'Do not pass input to a shell. Invoke the program directly — Command::new(prog).arg(userArg) without a shell — and validate inputs.',
+    });
+  });
+  return findings;
+}
+
+// Convenience: run every tree-sitter sink detector over a file-content map.
+export async function scanTreeSitterSinks(fileContents) {
+  if (process.env.AGENTIC_SECURITY_TREE_SITTER !== '1') return [];
+  const out = [];
+  for (const [fp, c] of Object.entries(fileContents || {})) {
+    if (typeof c !== 'string') continue;
+    try { out.push(...await scanTreeSitterRust(fp, c)); } catch { /* never fail the scan */ }
+  }
+  return out;
+}

package/src/sast/weak-password-hash.js

@@ -32,6 +32,34 @@ const PATTERNS = {
       { re: /\bsha1\.(?:Sum|New)\s*\(\s*(?:\[\]byte\s*\(\s*)?(\w+)/g, label: 'sha1.Sum/New' },
     ],
   },
+  ruby: {
+    ext: /\.rb$/i,
+    rules: [
+      { re: /\bDigest::(?:MD5|SHA1)\s*\.\s*(?:hexdigest|digest|base64digest)\s*\(\s*(\w+)/g, label: 'Digest::MD5/SHA1' },
+      { re: /\b(?:Digest::)?(?:MD5|SHA1)\.new[\s\S]{0,40}\.update\s*\(\s*(\w+)/g, label: 'Digest MD5/SHA1 new+update' },
+    ],
+  },
+  csharp: {
+    ext: /\.cs$/i,
+    rules: [
+      // MD5.Create()…ComputeHash(<var>) / MD5.HashData(<var>) — capture hashed var.
+      { re: /\b(?:MD5|SHA1)\s*\.\s*(?:Create\s*\(\s*\)\s*\.\s*ComputeHash|HashData)\s*\([\s\S]{0,120}?(\w+)\s*\)/g, label: 'MD5/SHA1 ComputeHash/HashData' },
+      { re: /\bnew\s+(?:MD5|SHA1)(?:CryptoServiceProvider|Managed)?\s*\(/g, label: 'MD5/SHA1 provider' },
+    ],
+  },
+  kotlin: {
+    ext: /\.kt$/i,
+    rules: [
+      { re: /\bMessageDigest\.getInstance\s*\(\s*"(?:MD5|SHA-?1)"\s*\)[\s\S]{0,80}?\.digest\s*\(\s*(\w+)/g, label: 'MessageDigest MD5/SHA-1' },
+    ],
+  },
+  php: {
+    ext: /\.(?:php|phtml)$/i,
+    rules: [
+      { re: /\b(?:md5|sha1)\s*\(\s*\$?(\w+)/g, label: 'md5()/sha1()' },
+      { re: /\bhash\s*\(\s*['"](?:md5|sha1)['"]\s*,\s*\$?(\w+)/g, label: 'hash("md5"/"sha1", …)' },
+    ],
+  },
 };
 
 export function scanWeakPasswordHash(fp, raw) {

package/src/sast/weak-randomness.js

@@ -9,8 +9,18 @@
 //   Go: rand.Intn(), rand.Int(), rand.Float64(), rand.Int31(), rand.Int63()
 //   Ruby: rand(), Random.rand, Random.new.rand
 //   PHP: rand(), mt_rand(), array_rand(), shuffle()
+//   Java: new Random(), Math.random(), ThreadLocalRandom.current().nextInt()
+//   Kotlin: Random.next*, kotlin.random.Random, java.util.Random
+//   C#: new Random()
 
 const SECURITY_CONTEXT = /\b(token|session|nonce|key|secret|password|otp|csrf|salt|code|pin|auth|reset|verify|captcha|challenge|ticket)\b/i;
+// camelCase carrier: a security term as the suffix of an identifier
+// (`newToken`, `genSecret`, `sessionId`) — `\bword\b` misses these. Case
+// sensitive so it only fires on the CamelCase boundary, not generic prose.
+const SECURITY_CONTEXT_CAMEL = /[a-z](?:Token|Secret|Nonce|Salt|Otp|Password|Passwd|ApiKey|SessionId|Csrf|Cookie|Jwt|Nonce)\b/;
+// snake_case carrier: same idea for `session_token`, `reset_token`,
+// `api_secret` — `\btoken\b` misses these because `_` is a word char.
+const SECURITY_CONTEXT_SNAKE = /_(?:token|secret|nonce|salt|otp|password|passwd|key|session|csrf|seed|cookie|jwt)\b/i;
 
 function _line(raw, idx) {
   return raw.slice(0, idx).split('\n').length;
@@ -47,6 +57,28 @@ const LANG_PATTERNS = {
       { re: /\b(?:rand|mt_rand|array_rand)\s*\(/g, label: 'rand() / mt_rand()' },
     ],
   },
+  java: {
+    ext: /\.java$/i,
+    patterns: [
+      { re: /\bnew\s+Random\s*\(/g, label: 'java.util.Random' },
+      { re: /\bMath\.random\s*\(\s*\)/g, label: 'Math.random()' },
+      { re: /\bThreadLocalRandom\.current\s*\(\s*\)\s*\.\s*next\w*\s*\(/g, label: 'ThreadLocalRandom (non-crypto)' },
+    ],
+  },
+  kotlin: {
+    ext: /\.kt$/i,
+    patterns: [
+      { re: /\bRandom\s*\(\s*\)\s*\.\s*next\w*\s*\(/g, label: 'Random() (non-crypto)' },
+      { re: /\bRandom\s*\.\s*(?:next\w+|Default)\b/g, label: 'kotlin.random.Random' },
+      { re: /\bnew\s+(?:java\.util\.)?Random\s*\(/g, label: 'java.util.Random' },
+    ],
+  },
+  csharp: {
+    ext: /\.cs$/i,
+    patterns: [
+      { re: /\bnew\s+Random\s*\(/g, label: 'System.Random' },
+    ],
+  },
 };
 
 export function scanWeakRandomness(fp, raw) {
@@ -67,10 +99,16 @@ export function scanWeakRandomness(fp, raw) {
       const lineStart = raw.lastIndexOf('\n', m.index) + 1;
       const lineEnd = raw.indexOf('\n', m.index);
       const lineText = raw.slice(lineStart, lineEnd > 0 ? lineEnd : raw.length);
-      if (!SECURITY_CONTEXT.test(lineText)) {
-        const prevLineStart = raw.lastIndexOf('\n', lineStart - 2) + 1;
-        const prevLine = raw.slice(prevLineStart, lineStart - 1);
-        if (!SECURITY_CONTEXT.test(prevLine)) continue;
+      if (!SECURITY_CONTEXT.test(lineText) && !SECURITY_CONTEXT_CAMEL.test(lineText) && !SECURITY_CONTEXT_SNAKE.test(lineText)) {
+        // Widen the lookback to the enclosing block: the security keyword is
+        // often on the function signature a few lines up (`function newToken()
+        // { … Math.random() … }`), not the line immediately before the call.
+        let winStart = lineStart;
+        for (let k = 0; k < 6 && winStart > 0; k++) {
+          winStart = raw.lastIndexOf('\n', winStart - 2) + 1;
+        }
+        const window = raw.slice(winStart, lineStart - 1);
+        if (!SECURITY_CONTEXT.test(window) && !SECURITY_CONTEXT_CAMEL.test(window) && !SECURITY_CONTEXT_SNAKE.test(window)) continue;
       }
       findings.push({
         id: `weak-rng:${fp}:${line}`,
@@ -79,7 +117,10 @@ export function scanWeakRandomness(fp, raw) {
         vuln: `Insecure Randomness — ${label} used for security-sensitive value`,
         severity: 'high',
         family: 'weak-rng',
-        cwe: 'CWE-330',
+        // CWE-338 (cryptographically weak PRNG) — more specific than the
+        // CWE-330 parent; every pattern here (Math.random / random.* / rand /
+        // math.rand) is a non-CSPRNG used in a security context.
+        cwe: 'CWE-338',
         parser: 'WEAK-RNG',
         confidence: 0.80,
         description: `${label} is not cryptographically secure. An attacker can predict the output and forge tokens, bypass OTP, or guess session identifiers.`,

package/src/sast/wrong-context-sanitizer.js

@@ -0,0 +1,94 @@
+// Wrong-context output encoding (roadmap #1, practical slice) — CWE-79.
+//
+// Context-aware sanitization is the single biggest XSS precision lever, but
+// the full model (context-tagged taint through the lattice) is a core-engine
+// change. This detector ships the most impactful, UNAMBIGUOUS case as a
+// standalone pattern rule:
+//
+//   An HTML-ENTITY encoder (escapeHtml / htmlspecialchars / he.encode /
+//   lodash.escape …) applied to a value that is then used as a URL
+//   (`.href` / `.src` / `location` / a JSX `href=`/`src=` attribute).
+//
+// HTML-entity encoding is the right tool for HTML *body/attribute text*. It
+// does NOT neutralize a dangerous URL SCHEME — `javascript:alert(1)` and
+// `data:text/html,…` survive entity-encoding unchanged, so the value is still
+// XSS-exploitable in a URL context. This is a textbook wrong-context bug and a
+// false sense of safety (the code looks sanitized).
+//
+// Deliberately high precision: only HTML-entity encoders (not generic names
+// like bare `escape`, not `encodeURIComponent`, which is a different — non-XSS
+// — mistake in URLs), and suppressed when a scheme/allow-list check is nearby.
+
+import { blankComments } from './_comment-strip.js';
+
+// Distinctive HTML-entity encoder callees. Intentionally excludes bare
+// `escape` (too generic) and `encodeURIComponent` (URL-encoding, not XSS).
+const HTML_ENCODER = "(?:escapeHtml|escapeHTML|htmlspecialchars|htmlentities|he\\.encode|he\\.escape|_\\.escape|lodash\\.escape)";
+
+const PATTERNS = [
+  // Assignment to a URL-bearing property: el.href = …escapeHtml(url)…
+  new RegExp("\\b(?:location(?:\\.href)?|[\\w$.]+\\.(?:href|src))\\s*=\\s*([^;\\n]*?\\b" + HTML_ENCODER + "\\s*\\([^;\\n]*)", "g"),
+  // JSX / template attribute: href={ escapeHtml(url) } / src="...${he.encode(u)}..."
+  new RegExp("\\b(?:href|src)\\s*=\\s*[{\"'`]?[^\"'`>;\\n]*?\\b" + HTML_ENCODER + "\\s*\\(", "g"),
+];
+
+// A nearby URL-scheme allow-list / validation makes the HTML-encoder a
+// belt-and-suspenders choice rather than the sole (wrong) defense → suppress.
+const SCHEME_GUARD = [
+  /\bstartsWith\s*\(\s*['"]https?:/i,
+  /\^https\?:/i,
+  /\bnew\s+URL\s*\(/,
+  /\ballow(?:ed|list)?\s*(?:schemes?|protocols?|hosts?)/i,
+  /\bprotocol\s*===?\s*['"]https?:/i,
+  /\bsanitizeUrl\b|\bisSafeUrl\b|\bvalidateUrl\b/i,
+];
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+function isJsLike(fp) { return /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp); }
+function isPhp(fp) { return /\.php$/i.test(fp); }
+
+export function scanWrongContextSanitizer(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  if (!isJsLike(fp) && !isPhp(fp)) return [];
+  // Cheap pre-filter: must contain both an HTML encoder and a URL sink token.
+  if (!/escapeHtml|htmlspecialchars|htmlentities|he\.|_\.escape|lodash\.escape/i.test(raw)) return [];
+  if (!/\b(?:href|src)\b|location/i.test(raw)) return [];
+
+  const code = blankComments(raw, isPhp(fp) ? undefined : undefined);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  for (const re of PATTERNS) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code))) {
+      const line = lineOf(code, m.index);
+      if (seen.has(line)) continue;
+      // Suppress when a scheme guard appears within 5 lines above.
+      const lo = Math.max(0, line - 6);
+      const near = lines.slice(lo, line).join('\n');
+      if (SCHEME_GUARD.some(g => g.test(near))) continue;
+      seen.add(line);
+      findings.push({
+        id: `wrong-context-sanitizer:${fp}:${line}`,
+        severity: 'medium',
+        file: fp,
+        line,
+        vuln: 'Wrong-context output encoding (HTML-encoded value used as a URL)',
+        cwe: 'CWE-79',
+        family: 'xss',
+        parser: 'SAST',
+        description:
+          'An HTML-entity encoder is applied to a value used in a URL context (href/src/location). ' +
+          'HTML-entity encoding does not neutralize dangerous URL schemes such as `javascript:` or ' +
+          '`data:`, so the value remains XSS-exploitable — while looking sanitized.',
+        remediation:
+          'Validate the URL scheme against an allow-list (e.g. only http/https) or build the URL with ' +
+          'the URL API; reserve HTML-entity encoding for HTML body/attribute text, not URLs.',
+      });
+    }
+  }
+  return findings;
+}

package/src/sast/xpath-injection.js

@@ -3,14 +3,32 @@ import { blankComments } from './_comment-strip.js';
 //
 // Same shape as LDAP injection — string concatenation into a query language
 // that has its own operators. We catch concatenation patterns into:
-//   - javax.xml.xpath / org.jaxen / org.dom4j  (Java)
+//   - javax.xml.xpath / org.jaxen / org.dom4j  (Java, Kotlin)
 //   - lxml.etree / xml.etree                   (Python)
 //   - xpath npm pkg                            (Node)
+//   - DOMXPath::query / ::evaluate             (PHP)
+//   - XPathNavigator.Select / SelectNodes      (C#)
+//   - Nokogiri xpath / REXML::XPath            (Ruby)
+//   - xmlpath / htmlquery / antchfx xpath      (Go)
+
+// A string literal whose body may contain the OTHER quote char — an XPath
+// expression like `"//user[@name='" + x` embeds a single quote, which a naive
+// `[^"']*` body would stop at. Match each quote style with its own body.
+const STR = String.raw`(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')`;
 
 const PATTERNS = {
-  java: /\.\s*(?:compile|evaluate)\s*\(\s*"[^"]*"\s*\+\s*\w+/g,
-  py:   /\.\s*(?:xpath|find|findall)\s*\(\s*["'][^"']*["']\s*[%+]\s*\w+|\.\s*xpath\s*\(\s*f["']/g,
-  js:   /\b(?:xpath|select)\s*\(\s*[`"][^`"]*[`"]\s*\+\s*\w+|\bxpath\.select\s*\(\s*`[^`]*\$\{/g,
+  java: new RegExp(String.raw`\.\s*(?:compile|evaluate)\s*\(\s*${STR}\s*\+\s*\w+`, 'g'),
+  kt:   new RegExp(String.raw`\.\s*(?:compile|evaluate)\s*\(\s*${STR}\s*\+\s*\w+|\.\s*(?:compile|evaluate)\s*\(\s*"[^"\n]*\$\{`, 'g'),
+  py:   new RegExp(String.raw`\.\s*(?:xpath|find|findall)\s*\(\s*${STR}\s*[%+]\s*\w+|\.\s*xpath\s*\(\s*[fF]["']`, 'g'),
+  js:   new RegExp(String.raw`\b(?:xpath|select)\s*\(\s*(?:` + '`' + String.raw`[^` + '`' + String.raw`]*` + '`' + String.raw`|${STR})\s*\+\s*\w+|\bxpath\.select\s*\(\s*` + '`' + String.raw`[^` + '`' + String.raw`]*\$\{`, 'g'),
+  // PHP DOMXPath: $xpath->query("…" . $u) / ->evaluate("…" . $u)
+  php:  new RegExp(String.raw`->\s*(?:query|evaluate)\s*\(\s*${STR}\s*\.\s*\$\w+`, 'g'),
+  // C#: nav.Select / doc.SelectNodes / SelectSingleNode / XPathSelectElements with concat
+  cs:   new RegExp(String.raw`\.\s*(?:Select|SelectNodes|SelectSingleNode|XPathSelectElement|XPathSelectElements|Compile)\s*\(\s*\$?${STR}\s*\+\s*\w+|\.\s*(?:Select|SelectNodes|SelectSingleNode)\s*\(\s*\$"[^"\n]*\{`, 'g'),
+  // Ruby Nokogiri / REXML: .xpath("…#{u}") / .at_xpath / XPath.match with #{} or concat
+  rb:   new RegExp(String.raw`\.\s*(?:xpath|at_xpath|search)\s*\(\s*(?:"[^"\n]*#\{|'[^'\n]*#\{)|\.\s*(?:xpath|at_xpath)\s*\(\s*${STR}\s*\+\s*\w+|XPath\s*\.\s*(?:match|first|each)\s*\([^,]+,\s*(?:"[^"\n]*#\{|'[^'\n]*#\{)`, 'g'),
+  // Go xmlpath/htmlquery/antchfx: xmlpath.Compile("…"+u) / htmlquery.Find(doc, "…"+u)
+  go:   new RegExp(String.raw`\b(?:xmlpath\.Compile|htmlquery\.(?:Find|FindOne|QueryAll|Query)|xpath\.Compile|navigator\.Compile)\s*\([^)]*${STR}\s*\+\s*\w+`, 'g'),
 };
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -20,11 +38,17 @@ export function scanXPathInjection(fp, raw) {
   let lang;
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) lang = 'js';
   else if (/\.java$/i.test(fp)) lang = 'java';
+  else if (/\.kt$/i.test(fp)) lang = 'kt';
   else if (/\.py$/i.test(fp)) lang = 'py';
+  else if (/\.(?:php|phtml)$/i.test(fp)) lang = 'php';
+  else if (/\.cs$/i.test(fp)) lang = 'cs';
+  else if (/\.rb$/i.test(fp)) lang = 'rb';
+  else if (/\.go$/i.test(fp)) lang = 'go';
   else return [];
 
-  const code = blankComments(raw, lang === 'py' ? 'py' : undefined);
-  if (!/\bxpath|XPath|\.xpath\(/i.test(code)) return [];
+  const code = blankComments(raw, (lang === 'py' || lang === 'rb') ? 'py' : undefined);
+  // Relevance gate: an XPath-ish API or an XPath expression literal must appear.
+  if (!/\bxpath|XPath|\.xpath\(|DOMXPath|SelectNodes|SelectSingleNode|XPathNavigator|xmlpath|htmlquery|REXML|\/\/\w/i.test(code)) return [];
   const re = new RegExp(PATTERNS[lang].source, PATTERNS[lang].flags);
   const findings = [];
   const seen = new Set();

package/src/sast/xss-reflected-multilang.js

@@ -0,0 +1,116 @@
+// Cross-language reflected-XSS structural detector — PRD Tier 1 (recall).
+//
+// JS/Python reflected XSS is handled by the flow engine + framework structural
+// detectors; the second-tier languages had no XSS coverage. This module adds a
+// taint-independent structural rule per language: user input written into an
+// HTML response via concatenation / interpolation, without an output encoder.
+//
+// Precision: each language carries its own escaper exclusion (htmlspecialchars,
+// HtmlEncode, html_escape, template.HTMLEscapeString, …). When an escaper is
+// applied on the sink line the finding is suppressed — the parameterized/encoded
+// form must NOT match. HTML context is required (an HTML tag literal, an HTML
+// content-type, or a raw-superglobal echo) so plain-text responses don't fire.
+
+import { blankComments } from './_comment-strip.js';
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+const REMEDIATION =
+  'HTML-encode user input before writing it into a response: htmlspecialchars (PHP), ' +
+  'template/html.EscapeString (Go), ERB::Util.html_escape / avoid .html_safe (Ruby), ' +
+  'HttpUtility.HtmlEncode (C#), or an auto-escaping template engine. Never concatenate ' +
+  'request data straight into an HTML response.';
+
+// Per-language: { ext, sinks:[RegExp], escaper:RegExp }. A line matches when a
+// sink RegExp matches and the escaper RegExp does NOT.
+const LANGS = {
+  go: {
+    ext: /\.go$/i,
+    // fmt.Fprint*/io.WriteString to the ResponseWriter, or w.Write([]byte(...)),
+    // building an HTML string ("<…") by concatenation.
+    sinks: [
+      /\b(?:fmt\.Fprintf?|fmt\.Fprintln|io\.WriteString)\s*\(\s*w\b[^)\n]*"<[^"\n]*"\s*\+/,
+      /\bw\.Write\s*\(\s*\[\]byte\s*\(\s*"<[^"\n]*"\s*\+/,
+    ],
+    escaper: /\b(?:template\.HTMLEscapeString|html\.EscapeString|template\.HTMLEscaper)\s*\(/,
+  },
+  php: {
+    ext: /\.(?:php|phtml)$/i,
+    // echo/print of a request superglobal (directly or concatenated).
+    sinks: [
+      /\b(?:echo|print)\b[^;\n]*\$_(?:GET|POST|REQUEST|COOKIE)\b/,
+      /\bprintf\s*\([^;\n]*\$_(?:GET|POST|REQUEST|COOKIE)\b/,
+    ],
+    escaper: /\b(?:htmlspecialchars|htmlentities|strip_tags|filter_var|urlencode|rawurlencode|json_encode|intval|floatval|htmlspecialchars_decode)\s*\(/,
+  },
+  ruby: {
+    ext: /\.rb$/i,
+    // render inline:/html: with #{} interpolation, raw(params…), params….html_safe
+    sinks: [
+      /\brender\s+(?:inline|html):\s*["'][^"'\n]*#\{/,
+      /\braw\s*\(\s*(?:params|request|@\w+\.params)\b/,
+      /\b(?:params|request)\b[^\n]*\.\s*html_safe\b/,
+    ],
+    escaper: /\b(?:ERB::Util\.html_escape|CGI\.escapeHTML|h\s*\(|sanitize\s*\()/,
+  },
+  csharp: {
+    ext: /\.cs$/i,
+    // Response.Write of Request data, or an HTML string concatenation.
+    sinks: [
+      /\bResponse\.Write\s*\([^)\n]*\bRequest\b/,
+      /\bResponse\.Write\s*\(\s*"<[^"\n]*"\s*\+/,
+    ],
+    escaper: /\b(?:HttpUtility\.HtmlEncode|HtmlEncoder\.|Server\.HtmlEncode|WebUtility\.HtmlEncode|AntiXss\.)/,
+  },
+  kotlin: {
+    ext: /\.kt$/i,
+    // Ktor respondText building HTML by interpolation/concat.
+    sinks: [
+      /\brespondText\s*\(\s*"<[^"\n]*\$/,
+      /\brespondText\s*\(\s*"<[^"\n]*"\s*\+/,
+      /\brespondText\s*\(\s*"[^"\n]*\$[^"\n]*"\s*,\s*ContentType\.Text\.Html/,
+    ],
+    escaper: /\b(?:htmlEscape|escapeHtml|HtmlUtils\.htmlEscape|encodeHTML)\s*\(/,
+  },
+  java: {
+    ext: /\.java$/i,
+    // Servlet: response.getWriter().write/print/println(...) or a PrintWriter
+    // `out`, building an HTML string ("<…") by concatenation. The concat (`"<…"
+    // +`) is the reflected-XSS shape — a static literal has no `+`.
+    sinks: [
+      /\.\s*(?:getWriter\s*\(\s*\)\s*\.\s*)?(?:write|print|println|append|format|printf)\s*\(\s*"<[^"\n]*"\s*\+/,
+      /\b(?:out|writer|pw|w)\s*\.\s*(?:write|print|println|append)\s*\(\s*"<[^"\n]*"\s*\+/,
+    ],
+    escaper: /\b(?:encodeForHTML|forHtml|forHtmlContent|htmlEscape|escapeHtml4?|StringEscapeUtils|HtmlUtils\.htmlEscape|Encode\.forHtml|ESAPI|OWASP)\b/,
+  },
+};
+
+export function scanXssReflectedMultilang(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  let lang = null;
+  for (const v of Object.values(LANGS)) { if (v.ext.test(fp)) { lang = v; break; } }
+  if (!lang) return [];
+
+  const code = blankComments(raw, /\.(?:rb|php)$/i.test(fp) ? 'py' : undefined);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (lang.escaper.test(line)) continue;
+    if (!lang.sinks.some((re) => re.test(line))) continue;
+    const ln = i + 1;
+    const id = `xss-reflected:${fp}:${ln}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line: ln,
+      vuln: 'Reflected XSS — user input written into an HTML response without output encoding',
+      severity: 'high', cwe: 'CWE-79', family: 'xss', parser: 'XSS-ML', confidence: 0.62,
+      snippet: (raw.split('\n')[ln - 1] || '').trim().slice(0, 200),
+      remediation: REMEDIATION,
+    });
+  }
+  return findings;
+}

package/src/sast/xxe.js

@@ -64,6 +64,28 @@ const PYTHON_DEFUSED_RE = /(?:^|\n)\s*(?:from\s+defusedxml\b|import\s+defusedxml
 // upstream-recommended safe shape.
 const PYTHON_LXML_SAFE_RE = /XMLParser\s*\([^)]*\bresolve_entities\s*=\s*False\b[^)]*\)/;
 
+// ── PHP / Go / Ruby ─────────────────────────────────────────────────────────
+// Each of these XML stacks is XXE-SAFE BY DEFAULT in current versions; the
+// vulnerability appears only when the caller explicitly opts INTO external-
+// entity / DTD-loading behavior. So we flag the opt-in flags, not the parse
+// call itself — the plain parse is correctly clean.
+//
+// PHP:   loadXML / simplexml_load_string|file with LIBXML_NOENT, LIBXML_DTDLOAD,
+//        or LIBXML_DTDVALID. (PHP >= 8.0 disables entity substitution by
+//        default; these flags re-enable it.)
+const PHP_XXE_RE =
+  /\b(?:loadXML|simplexml_load_string|simplexml_load_file)\s*\([^;]*\bLIBXML_(?:NOENT|DTDLOAD|DTDVALID)\b/g;
+// Go:   encoding/xml Decoder made unsafe by `Strict = false` or a custom
+//       `Entity` map that defines expansions. Gated on an xml-decoder hint.
+const GO_XXE_RE =
+  /\b\w+\s*\.\s*(?:Strict\s*=\s*false|Entity\s*=\s*(?:map\[string\]string|xml\.HTMLEntity))/g;
+const GO_XML_HINT_RE = /\b(?:encoding\/xml|xml\.NewDecoder|xml\.Decoder)\b/;
+// Ruby: Nokogiri parse whose options enable NOENT / DTDLOAD / replace_entities.
+//       Default Nokogiri::XML(xml) is safe. Gated on a Nokogiri/LibXML hint.
+const RUBY_XXE_RE =
+  /\.\s*(?:noent|dtdload|dtdvalid|replace_entities)\b/g;
+const RUBY_XML_HINT_RE = /\bNokogiri\s*::\s*XML\b|\bLibXML\b|\bXML::Parser\b/;
+
 import { blankComments } from './_comment-strip.js';
 
 function _stripLineComment(s, lang) {
@@ -136,5 +158,50 @@ export function scanXXE(fp, raw) {
     return findings;
   }
 
+  // ── PHP / Go / Ruby: flag the explicit opt-in to external entities ──────────
+  const _emitOptIn = (code, re, gate, mkVuln, mkRem) => {
+    if (gate && !gate.test(code)) return;
+    const r = new RegExp(re.source, re.flags);
+    let m;
+    const seen = new Set();
+    while ((m = r.exec(code))) {
+      const line = _lineOf(raw, m.index);
+      if (seen.has(line)) continue;
+      seen.add(line);
+      findings.push({
+        id: `xxe:${fp}:${line}`,
+        file: fp, line,
+        vuln: mkVuln(), severity: 'high', cwe: 'CWE-611',
+        stride: 'Information Disclosure',
+        snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+        remediation: mkRem(), confidence: 0.8, parser: 'XXE',
+      });
+    }
+  };
+
+  if (/\.(?:php|phtml)$/i.test(fp)) {
+    const code = blankComments(raw, 'py');
+    _emitOptIn(code, PHP_XXE_RE, null,
+      () => 'XXE: XML parsed with LIBXML_NOENT / LIBXML_DTDLOAD (external entities enabled)',
+      () => 'Drop the LIBXML_NOENT / LIBXML_DTDLOAD flags — PHP >= 8.0 disables entity substitution by default, so plain loadXML($xml) / simplexml_load_string($xml) is safe. If you must accept DTDs, set libxml_set_external_entity_loader to reject network/file access.');
+    return findings;
+  }
+
+  if (/\.go$/i.test(fp)) {
+    const code = blankComments(raw);
+    _emitOptIn(code, GO_XXE_RE, GO_XML_HINT_RE,
+      () => 'XXE: encoding/xml Decoder configured with Strict=false or a custom Entity map',
+      () => 'Go\'s encoding/xml ignores external entities by default — do not set Strict=false or populate Decoder.Entity with untrusted input. Leave the decoder at its defaults.');
+    return findings;
+  }
+
+  if (/\.rb$/i.test(fp)) {
+    const code = blankComments(raw, 'py');
+    _emitOptIn(code, RUBY_XXE_RE, RUBY_XML_HINT_RE,
+      () => 'XXE: Nokogiri parse options enable external entities (NOENT / DTDLOAD / replace_entities)',
+      () => 'Remove noent/dtdload/replace_entities — Nokogiri::XML(xml) is safe by default (entities are not expanded, DTDs are not loaded). Never enable these on untrusted XML.');
+    return findings;
+  }
+
   return [];
 }