@clear-capabilities/agentic-security-scanner 0.86.0 → 0.118.2

package/src/sast/.agentic-security/threat-model.md

@@ -0,0 +1,91 @@
+# Threat Model (auto-generated)
+
+Generated by agentic-security on 2026-06-01.
+
+This threat model is derived from static analysis of the current codebase and is regenerated on every scan. It is intended as a working artifact, not a finished compliance document.
+
+## Entities + boundaries
+
+```mermaid
+flowchart TB
+  subgraph External
+    route_GET___________________________________________________["http-route: GET                                                                                                                                   
+      parser: "]
+    queue_sensitive_data_logging_js_67["queue-consumer:  sensitive-data-logging.js:67"]
+  end
+  subgraph Application
+  end
+  External --> route_GET___________________________________________________
+  External --> queue_sensitive_data_logging_js_67
+```
+
+## Assets
+
+
+## STRIDE threats
+
+### Tampering (31)
+
+- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:105` — TLS certificate verification disabled — MITM-vulnerable
+- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:108` — TLS certificate verification disabled — MITM-vulnerable
+- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:114` — TLS certificate verification disabled — MITM-vulnerable
+- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:116` — TLS certificate verification disabled — MITM-vulnerable
+- [medium] **crypto-tls-no-verify** (CWE-295) at `crypto-protocol.js:118` — TLS certificate verification disabled — MITM-vulnerable
+- [medium] **eth-sign-used** (CWE-345) at `dapp-frontend.js:74` — eth_sign — signs arbitrary 32-byte hash with no prefix (the "death sign")
+- [medium] **spec-drift** (CWE-770) at `rate-limit.js:34` — Spec drift — _hasRateLimit() claims rate-limit-impl but body lacks expected evidence
+- [medium] **spec-drift** (CWE-770) at `rate-limit.js:77` — Spec drift — scanRateLimit() claims rate-limit-impl but body lacks expected evidence
+- [low] **idor** (CWE-347) at `authz.js:33` — AuthZ: jwt.verify called without algorithms allow-list
+- [low] **cache-poisoning** (CWE-349) at `cache-poisoning.js:20` — Cache Poisoning — X-Forwarded-Host reflected from request to response
+- [low] **client-side-eval-with-dynamic-input** (CWE-95) at `client-side.js:135` — Client-Side — eval with Dynamic Input
+- [low] **client-side-eval-with-dynamic-input** (CWE-95) at `client-side.js:139` — Client-Side — eval with Dynamic Input
+- [low] **client-side-eval-with-dynamic-input** (CWE-95) at `client-side.js:140` — Client-Side — eval with Dynamic Input
+- [low] **idor** (CWE-347) at `crypto-protocol.js:374` — AuthZ: jwt.verify called without algorithms allow-list
+- [low] **idor** (CWE-347) at `crypto-protocol.js:375` — AuthZ: jwt.verify called without algorithms allow-list
+- [low] **crypto-tls-version** (CWE-326) at `crypto-protocol.js:67` — TLS configured to accept versions below TLS 1.2
+- [low] **crypto-tls-version** (CWE-326) at `crypto-protocol.js:69` — TLS configured to accept versions below TLS 1.2
+- [low] **crypto-jwt-key-confusion** (CWE-345) at `crypto-protocol.js:374` — jwt.verify called without algorithms allowlist — algorithm-confusion attack
+- [low] **prompt-template-user-input-interpolated-** (CWE-1336) at `k8s-admission.js:139` — Prompt Template: user input interpolated into prompt string without isolation
+- [low] **llm-app-security** (CWE-1427) at `llm-app.js:93` — Prompt Injection — system prompt concatenated with user input
+- [low] **llm-app-security** (CWE-1427) at `llm-app.js:136` — RAG Injection — vector-store result flows into LLM prompt without sanitization
+- [low] **llm-app-security** (CWE-1427) at `llm-app.js:137` — RAG Injection — vector-store result flows into LLM prompt without sanitization
+- [low] **prompt-injection-system-prompt-built-fro** (CWE-1427) at `llm-owasp.js:180` — Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)
+- [low] **prompt-injection-system-prompt-built-fro** (CWE-1427) at `llm-owasp.js:181` — Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)
+- [low] **prompt-injection-system-prompt-built-fro** (CWE-1427) at `llm-owasp.js:182` — Prompt Injection — system prompt built from concatenated/interpolated content (LLM01)
+- … and 6 more
+
+### Information Disclosure (17)
+
+- [low] **crypto-weak-cipher** (CWE-327) at `crypto-protocol.js:141` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
+- [low] **crypto-weak-cipher** (CWE-327) at `crypto-protocol.js:143` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
+- [low] **crypto-weak-cipher** (CWE-327) at `crypto-protocol.js:145` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
+- [low] **crypto-weak-cipher** (CWE-327) at `crypto-protocol.js:149` — Weak symmetric cipher in use (DES / 3DES / RC4 / Blowfish / NULL / EXPORT)
+- [low] **pqc-migration** (CWE-327) at `post-quantum-crypto.js:136` — Pre-quantum RSA (rsa-encrypt) — replace with ML-KEM-768 before CRQC arrives
+- [low] **zip-slip** (CWE-22) at `zip-slip.js:192` — Zip Slip: archive entry.path written to filesystem without sanitization
+- [low] **ssrf** (CWE-918) at `csharp-structural.js:60` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `go-extended.js:39` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `java-structural.js:76` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `js-framework-structural.js:69` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `kotlin.js:136` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `php.js:111` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `python-sinks.js:186` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:61` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:86` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:15` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **crypto-weak-hash** (CWE-327) at `weak-password-hash.js:45` — Weak hash algorithm (MD5 / SHA-1 / MD2 / MD4) used
+
+### Elevation of Privilege (12)
+
+- [low] **llm-app-security** (CWE-502) at `llm-app.js:163` — Untrusted Model Load — model file loaded from a non-literal path
+- [low] **llm-app-security** (CWE-502) at `model-load.js:45` — Untrusted Model Load — model file loaded from a non-literal path
+- [low] **ssrf** (CWE-918) at `csharp-structural.js:60` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `go-extended.js:39` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `java-structural.js:76` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `js-framework-structural.js:69` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `kotlin.js:136` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `php.js:111` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `python-sinks.js:186` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:61` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:86` — SSRF: explicit reference to cloud instance-metadata endpoint
+- [low] **ssrf** (CWE-918) at `ssrf-cloud-metadata.js:15` — SSRF: explicit reference to cloud instance-metadata endpoint
+
+## Attack trees

package/src/sast/CLAUDE.md

@@ -13,11 +13,17 @@ SAST detector modules. Each file exports one or more `scan*()` functions returni
 
 ## What lives here, by category
 
-**Language-specific** — `cpp.js`, `csharp.js`, `dart-flutter.js`, `go-extended.js`, `java-deserialization.js`, `kotlin.js`, `php.js`, `python-sinks.js`, `ruby.js`, `rust.js`, `solidity.js`, `swift.js`, `xxe.js`.
+**Language-specific** — `cpp.js`, `csharp.js`, `csharp-structural.js` (regex structural: hardcoded-secret incl. split-concat + guarded SSRF — complements the flow-based `csharp.js`), `dart-flutter.js`, `go-extended.js`, `java-deserialization.js`, `java-structural.js` (regex structural SQLi/cmdi/path/SSRF via concat, with path/SSRF guards — complements the AST/flow Java modules), `kotlin.js` (Kotlin idioms + **taint-independent structural injection** detectors: SQLi/cmdi/path via string template/concat, SSRF (guarded), XXE (insecure XML config), ObjectInputStream deser — closes the corpus Kotlin FNs where a tainted-by-convention param has no in-file source), `php.js` (+ structural SQLi/cmdi via concat/`$`-interp: DB::raw/whereRaw, shell_exec/exec; structural path traversal: readfile/file_get_contents/fopen with concat), `python-sinks.js`, `ruby.js` (+ structural ActiveRecord SQLi via `#{}`/concat, backtick/system cmdi, and File/IO path traversal via interpolation/concat), `rust.js`, `solidity.js`, `swift.js`, `xxe.js` (CWE-611 for Java/Python **and** PHP/Go/Ruby — each non-JVM stack is XXE-safe by default, so it flags the explicit external-entity opt-in: PHP `LIBXML_NOENT`/`LIBXML_DTDLOAD`, Go `xml.Decoder` `Strict=false`/custom `Entity`, Ruby Nokogiri `noent`/`dtdload`/`replace_entities`; default-safe parses don't match).
+
+> **Structural-detector pattern (Tier 1 recall).** `kotlin.js`/`ruby.js`/`php.js` carry taint-independent rules: a dangerous sink built with string interpolation/concat is the injection shape regardless of variable names. This closes corpus FNs where a value is routed through a local var (`params[:x]` → `where("…#{x}")`) so the taint engine sees no source. Keep them high-precision: parameterized / array-form / literal variants must NOT match. Verify on the cve-replay `pre/`+`post/` pairs.
+
+**Tree-sitter (long-tail languages, opt-in)** — `tree-sitter-sinks.js` (roadmap #8). AST-accurate detectors for languages with no first-class IR parser (rust/solidity/cpp/go/swift/dart), via `../ir/tree-sitter-loader.js`. Gated behind `AGENTIC_SECURITY_TREE_SITTER=1` and the **optional** `web-tree-sitter` + `tree-sitter-wasms` deps (ABI-pinned 0.20.8 ↔ 0.1.13, marked `--external` so they're never bundled). Degrades to a no-op when the flag or deps are absent. First rule: Rust shell-spawn command injection (CWE-78). Anchoring on real AST nodes means comments/strings can't false-match.
 
 **Framework hardening** — `django-hardening.js`, `fastapi-hardening.js`, `laravel-hardening.js`, `quarkus-hardening.js`, `springboot-hardening.js`. Each detects "you used framework X but forgot the security-hardening step that ships with it" rather than a primary vuln.
 
-**Cross-cutting vuln classes** — `authz.js`, `csrf.js`, `host-header.js`, `jndi.js`, `jwt-exp.js`, `ldap-injection.js`, `xpath-injection.js`, `mass-assignment.js`, `mutation-xss.js`, `nosql-injection.js`, `prototype-pollution.js`, `ssrf-cloud-metadata.js`, `toctou.js`, `zip-slip.js`.
+**Framework structural (taint-independent, JS/Py recall)** — `js-framework-structural.js` (Express/Koa/NestJS/TypeORM: SQLi via `.query`/`.execute` concat-template, koa-send path, `ctx.body` XSS, HttpService SSRF, deep-merge prototype pollution) `python-structural.js` (Flask `render_template_string` XSS/SSTI, Django `.raw`/`.extra` + `cursor.execute` SQLi — robust string-literal matching spans embedded quotes like `"… name = '" + x`; `open()`/`send_file` path traversal via concat/f-string, CWE-22 deferring to `dropGuardedFindings`), and `go-structural.js` (db query + `fmt.Sprintf`/concat SQLi, `os.Open` + concat/Sprintf path traversal). High precision: parameterized/escaped/`{{ }}`-Jinja/`%s`-placeholder forms do NOT match; SSRF/path findings defer to `engine.js dropGuardedFindings` (which also drops a reflected-XSS finding when the reflected value passed through a captured HTML escaper — a *discarded* `escapeHtml(s);` does not count — and skips already-`isSanitized` findings so the suppression pipeline keeps its bookkeeping).
+
+**Cross-cutting vuln classes** — `authz.js`, `csrf.js` (POST/PUT/PATCH/DELETE state-changing routes without CSRF defence; defence-aware suppression covers Express/Fastify/Flask/Django/FastAPI/Spring/Symfony **and Go (gin/echo/mux), Rails routes, ASP.NET MVC** — recognizes `gorilla/csrf`/`protect_from_forgery`/`[ValidateAntiForgeryToken]` defences and exempts token-auth (`[ApiController]`, Bearer scheme); bare ASP.NET `[Authorize]` still flags as cookie auth is CSRF-vulnerable), `code-injection-multilang.js` (CWE-94 for Java/C#/Go/Kotlin — dynamic code/expression evaluators on a NON-LITERAL argument: javax.script `eval`, GroovyShell, Spring SpEL `parseExpression`, MVEL/OGNL, Roslyn `CSharpScript`, `DataTable.Compute`, yaegi `interp.Eval`, `text/template` Parse of a user-controlled body; literal arguments don't match. JS/Python/Ruby eval stay with the flow engine + per-language modules), `csv-injection.js` (formula injection into spreadsheet cells, CWE-1236), `secret-concat.js` (language-agnostic hardcoded-secret SPLIT across concatenated literals — `'AKIA' + 'IOSF…'` / `'ghp' + '_…'` / `'sk' + '_live_…'` — reassembled and matched against provider prefixes; complements the contiguous-token secrets scanner and the C#-only split-concat rule), `host-header.js`, `jndi.js`, `jwt-exp.js`, `ldap-injection.js` (CWE-90 across JS/Java/Python **and** PHP/Go/C#/Ruby/Kotlin — filter built by concat/interpolation; an inline call-guard and a file-level escape-API guard suppress `ldap_escape`/`EscapeFilter`/`escape_filter_chars`/`Net::LDAP::Filter`/`EqualityFilter` forms), `xpath-injection.js` (CWE-643 across Java/Python/JS **and** PHP/Go/Ruby/C#/Kotlin — XPath expression built by concat/interpolation: `DOMXPath->query`, `SelectNodes`, Nokogiri `.xpath`, htmlquery/xmlpath, `XPath.compile`; embedded-quote-tolerant literal matching; parameterized/variable-bound APIs and static literals don't match), `mass-assignment.js`, `mutation-xss.js`, `nosql-injection.js`, `prototype-pollution.js`, `response-splitting.js` (CWE-113 CRLF/header injection across JS/Python/Java/PHP/Go/Ruby/C#/Kotlin — a response header value set from a request source without stripping CR/LF; recognizes CRLF-strip sanitizers — `.replace(/[\r\n]/)`, chained `.replace("\r")`, Ruby `gsub`/`delete`, Go `strings.NewReplacer`, PHP `str_replace` — and a request-scope param heuristic for the JVM/C# single-file shape), `ssrf-cloud-metadata.js`, `xss-reflected-multilang.js` (cross-language reflected XSS for Go/Ruby/PHP/C#/Kotlin/Java — user input written into an HTML response via concat/interpolation, e.g. Java servlet `response.getWriter().write("<…" + q)`, with a per-language escaper exclusion so `htmlspecialchars`/`HtmlEncode`/`template.HTMLEscapeString`/ERB `<%= %>`/OWASP `Encode.forHtml` forms don't match; JS/Python XSS stays with the flow engine + framework structural detectors), `stored-taint.js` (second-order / stored injection — **opt-in** via `AGENTIC_SECURITY_STORED_TAINT=1`), `toctou.js`, `wrong-context-sanitizer.js` (HTML-entity encoder used in a URL context — wrong-context output encoding, CWE-79), `zip-slip.js`.
 
 **Cloud/infra** — `db-rls.js` (Supabase RLS), `env-hygiene.js` (NEXT_PUBLIC_ leaks, .env.example real values), `mobile-manifest.js`, `pipeline.js` (CI/CD integrity), `rate-limit.js`, `webhook.js`.
 
@@ -25,7 +31,7 @@ SAST detector modules. Each file exports one or more `scan*()` functions returni
 
 **Agent-of-agent / Claude Code hardening** — `claude-hook-injection.js`, `claude-md-prompt-injection.js`, `claude-settings.js`.
 
-**Auth / web** — `auth-provider.js`, `client-side.js`.
+**Auth / web** — `auth-provider.js`, `client-side.js`, `frontend-hygiene.js` (reverse tabnabbing CWE-1022, missing Subresource Integrity CWE-353, Angular `bypassSecurityTrust*` sanitizer-bypass CWE-79).
 
 **Bench-shape adapters (label-leakage, OFF by default)** — `bench-shape/` directory, plus `cpp-bench-extras.js`, `java-bench-extras.js`, `juliet-shape.js`, `primary-cwe-java.js`. These read Juliet / OWASP-Benchmark answer keys. Disabled unless `AGENTIC_SECURITY_BENCH_SHAPE=1`; `AGENTIC_SECURITY_BLIND_BENCH=1` overrides to force everything off. **Never use their emissions as a quality signal.**
 

package/src/sast/code-injection-multilang.js

@@ -0,0 +1,117 @@
+// Cross-language code-injection detector (CWE-94) — Java / C# / Go / Kotlin.
+//
+// The JS/Python/Ruby eval-family sinks are covered by the flow engine + the
+// per-language modules. The compiled second-tier languages had no CWE-94
+// coverage at all. This module flags the canonical dynamic-code-execution
+// sinks in those languages when the evaluated argument is NON-LITERAL (a
+// variable or expression) — a literal `eval("1+1")` is not injection.
+//
+// Sinks covered:
+//   Java/Kotlin (JVM):
+//     - javax.script ScriptEngine.eval(<expr>)
+//     - GroovyShell().evaluate(<expr>) / GroovyShell.parse
+//     - Spring SpEL: (Spel)ExpressionParser().parseExpression(<expr>)
+//     - MVEL.eval / OGNL: Ognl.getValue / OgnlUtil
+//   C#:
+//     - Roslyn: CSharpScript.EvaluateAsync/RunAsync(<expr>)
+//     - DataTable().Compute(<expr>, …)  (expression evaluator → injection)
+//   Go:
+//     - yaegi/gomacro interpreter: interp.Eval(<expr>)
+//     - text/template|html/template Parse(<expr>) of a NON-LITERAL template
+//       (user-controlled template body → action/code execution)
+//
+// Precision: the matched argument must not be a string literal. Escaped/safe
+// constructs (a literal template, a constant expression) don't match.
+
+import { blankComments } from './_comment-strip.js';
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+// A non-literal argument: an identifier / member / call expression — i.e. NOT
+// a bare string/char/number literal as the whole argument. Used as a trailing
+// assertion `(?!\s*STRING\s*\))` after the opening paren.
+const STR_LIT = String.raw`(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|@?"[^"]*")`;
+
+const REMEDIATION =
+  'Never evaluate runtime-built code. Replace the dynamic evaluator with an explicit ' +
+  'dispatch table / allow-list of operations, a sandboxed expression library with no ' +
+  'I/O and a fixed grammar, or precompiled templates whose body is never user-controlled. ' +
+  'For Spring SpEL use a SimpleEvaluationContext (no type/bean access); for Go templates ' +
+  'keep the template body static and pass values as data, never Parse user input.';
+
+// Per-language sink patterns. Each is built so the argument is captured and a
+// negative lookahead rejects a pure string-literal argument.
+function patternsFor(lang) {
+  // `(?!\s*<str>\s*[),])` — reject when the FIRST argument is a bare literal.
+  const notLiteral = String.raw`(?!\s*${STR_LIT}\s*[),])`;
+  if (lang === 'java' || lang === 'kt') {
+    return [
+      // ScriptEngine.eval(expr) — but not eval(reader) literal; require non-literal.
+      { key: 'script-eval', re: new RegExp(String.raw`\.\s*eval\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:ScriptEngine|ScriptEngineManager|getEngineByName|javax\.script|NashornScriptEngine)\b/ },
+      { key: 'groovy', re: new RegExp(String.raw`\bGroovyShell\s*\([^)]*\)\s*\.\s*(?:evaluate|parse)\s*\(\s*${notLiteral}`, 'g') },
+      { key: 'groovy2', re: new RegExp(String.raw`\b(?:GroovyShell|GroovyClassLoader)\b[\s\S]{0,120}?\.\s*(?:evaluate|parse|parseClass)\s*\(\s*${notLiteral}`, 'g') },
+      { key: 'spel', re: new RegExp(String.raw`\bparseExpression\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:SpelExpressionParser|ExpressionParser|org\.springframework\.expression)\b/ },
+      { key: 'mvel', re: new RegExp(String.raw`\bMVEL\s*\.\s*(?:eval|evalToString|compileExpression|executeExpression)\s*\(\s*${notLiteral}`, 'g') },
+      { key: 'ognl', re: new RegExp(String.raw`\bOgnl\s*\.\s*(?:getValue|setValue|parseExpression)\s*\(\s*${notLiteral}`, 'g') },
+    ];
+  }
+  if (lang === 'cs') {
+    return [
+      { key: 'roslyn', re: new RegExp(String.raw`\bCSharpScript\s*\.\s*(?:EvaluateAsync|RunAsync|Create)\s*\(\s*${notLiteral}`, 'g') },
+      { key: 'datatable-compute', re: new RegExp(String.raw`\.\s*Compute\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:DataTable|DataColumn|DataView)\b/ },
+    ];
+  }
+  if (lang === 'go') {
+    return [
+      // yaegi / gomacro interpreter eval of a non-literal.
+      { key: 'interp-eval', re: new RegExp(String.raw`\.\s*Eval\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:interp|yaegi|gomacro|Interpreter)\b/ },
+      // template Parse of a non-literal template body (user-controlled template).
+      { key: 'template-parse', re: new RegExp(String.raw`\.\s*Parse\s*\(\s*${notLiteral}`, 'g'),
+        gate: /\b(?:text\/template|html\/template|template\.New)\b/ },
+    ];
+  }
+  return [];
+}
+
+function _lang(fp) {
+  if (/\.java$/i.test(fp)) return 'java';
+  if (/\.kt$/i.test(fp)) return 'kt';
+  if (/\.cs$/i.test(fp)) return 'cs';
+  if (/\.go$/i.test(fp)) return 'go';
+  return null;
+}
+
+export function scanCodeInjectionMultilang(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  const lang = _lang(fp);
+  if (!lang) return [];
+  const code = blankComments(raw);
+  const pats = patternsFor(lang);
+  const findings = [];
+  const seen = new Set();
+
+  for (const { key, re, gate } of pats) {
+    if (gate && !gate.test(code)) continue;
+    const r = new RegExp(re.source, re.flags);
+    let m;
+    while ((m = r.exec(code))) {
+      const line = lineOf(code, m.index);
+      const id = `code-injection-ml:${fp}:${line}:${key}`;
+      if (seen.has(id)) continue;
+      seen.add(id);
+      findings.push({
+        id, file: fp, line,
+        vuln: 'Code Injection — dynamic code/expression evaluation of a non-literal argument',
+        severity: 'critical', cwe: 'CWE-94', family: 'code-injection',
+        parser: lang.toUpperCase(), confidence: 0.7, stride: 'Elevation of Privilege',
+        snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+        remediation: REMEDIATION,
+      });
+    }
+  }
+  return findings;
+}

package/src/sast/crypto-protocol.js

@@ -54,7 +54,7 @@ function _shape(file, line, ruleId, vuln, fam, sev, cwe, remediation, descriptio
   };
 }
 
-const _RELEVANCE = /\bTLS\b|\bSSL\b|\btls\b|tls_version|tls_minimum|min[_-]?version|min[_-]?protocol|verify|ciph(?:er|ersuite)|NODE_TLS|InsecureSkipVerify|rejectUnauthor|trust[_-]?all|allow[_-]?all|jwt\.|jsonwebtoken|jose|PyJWT|jwt\b|MD5|SHA1|sha-?1\b|md5\b|DES\b|3DES|RC4|Blowfish|ECB|pbkdf2|PBKDF2|bcrypt|scrypt|argon2|Math\.random|random\.random|java\.util\.Random|new Random/i;
+const _RELEVANCE = /\bTLS\b|\bSSL\b|\btls\b|tls_version|tls_minimum|min[_-]?version|min[_-]?protocol|verify|ciph(?:er|ersuite)|NODE_TLS|InsecureSkipVerify|rejectUnauthor|trust[_-]?all|allow[_-]?all|jwt\.|jsonwebtoken|jose|PyJWT|jwt\b|MD5|SHA1|sha-?1\b|md5\b|DES\b|3DES|RC4|Blowfish|ECB|pbkdf2|PBKDF2|bcrypt|scrypt|argon2|Math\.random|random\.random|java\.util\.Random|new Random|IvParameterSpec|GCMParameterSpec|openssl_encrypt|createCipher|\bAES\b|\baes\b|\.iv\s*=|\bIV\b/i;
 
 function _isCryptoRelevant(text) { return _RELEVANCE.test(text); }
 
@@ -148,6 +148,15 @@ function detectWeakCiphers(file, raw, code, out, seen) {
     { re: /\bciphers\s*:\s*['"`][^'"`]*(?:NULL|RC4|EXPORT|aNULL|eNULL|3DES|DES-CBC)/g },
     // Go cipher.NewTripleDESCipher
     { re: /\bcipher\.New(?:TripleDESCipher|DESCipher)\b/g },
+    // Go crypto/des + crypto/rc4 package constructors
+    { re: /\b(?:des\.New(?:TripleDESCipher|Cipher)|rc4\.NewCipher)\s*\(/g },
+    // PHP openssl_encrypt/openssl_decrypt with a weak algorithm string.
+    { re: /\bopenssl_(?:encrypt|decrypt)\s*\([^;)]*,\s*["'](?:des|des-ede3?|3des|rc4|rc2|bf|blowfish|cast5|seed)\b[^"']*["']/gi },
+    // PHP legacy mcrypt with DES/3DES/RC4/Blowfish.
+    { re: /\bmcrypt_(?:encrypt|decrypt|module_open)\s*\(\s*(?:MCRYPT_(?:DES|3DES|TRIPLEDES|ARCFOUR|RC2|RC4|BLOWFISH|CAST_128)|["'](?:des|tripledes|arcfour|rc2|rc4|blowfish)["'])/gi },
+    // Ruby OpenSSL::Cipher.new("DES-…"/"RC4"/"bf-…") or OpenSSL::Cipher::DES.new
+    { re: /\bOpenSSL::Cipher\.new\s*\(\s*["'](?:des|des-ede3?|3des|rc4|rc2|bf|blowfish|cast5|seed)\b[^"']*["']/gi },
+    { re: /\bOpenSSL::Cipher::(?:DES|RC4|RC2|Blowfish|CAST5)\b/g },
   ];
   for (const p of patterns) {
     let m;
@@ -196,8 +205,41 @@ function detectStaticIv(file, raw, code, out, seen) {
     { re: /\bcreateCipheriv\s*\([^,]+,\s*[^,]+,\s*['"`](?:0+|\\0+)['"`]/g },
     { re: /\bAES\.new\s*\([^,]+,[^,]+,\s*IV\s*=\s*b?['"](?:\\x00){8,}/g },
     { re: /\bcipher\.NewCBCEncrypter\s*\([^,]+,\s*make\s*\(\s*\[\]byte\s*,/g },  // make([]byte, blocksize)
+    // pyca/cryptography: a zero / repeated-byte literal IV — `iv = b'\x00' * 16`
+    // or `iv = b'\x00\x00…'` — fed to modes.CBC/CTR/CFB/OFB.
+    { re: /\biv\s*=\s*b['"](?:\\x00|\\0|0)+['"]\s*\*\s*\d+/gi },
+    { re: /\biv\s*=\s*b['"](?:\\x00|\\0){8,}['"]/gi },
+    { re: /\bmodes\.(?:CBC|CTR|CFB|OFB|GCM)\s*\(\s*b['"]/g },  // modes.CBC(b'…') literal IV/nonce
+    // Java/Kotlin: IvParameterSpec / GCMParameterSpec built from a freshly
+    // zero-initialized array (`new byte[16]` / `ByteArray(16)`) — no CSPRNG.
+    { re: /\b(?:Iv|GCM)ParameterSpec\s*\(\s*new\s+byte\s*\[\s*\d+\s*\]/g },          // Java
+    { re: /\b(?:Iv|GCM)ParameterSpec\s*\(\s*ByteArray\s*\(\s*\d+\s*\)/g },           // Kotlin
+    // Go: an IV/nonce that is `iv := make([]byte, …)` (all-zero, never filled
+    // from a CSPRNG) used with a stream/block-mode constructor. The `make`
+    // assignment usually precedes the NewXxx call, so gate on both being
+    // present in the file (NewXxx hint) and flag the make line.
+    { re: /\b\w*iv\w*\s*:?=\s*make\s*\(\s*\[\]byte\s*,/gi,
+      goGate: /\bcipher\.New(?:CBCEncrypter|CBCDecrypter|CTR|CFBEncrypter|CFBDecrypter|OFB)\b/,
+      // Safe if the file fills the IV from a CSPRNG — rand.Read(iv) /
+      // io.ReadFull(rand.Reader, iv) / crypto/rand usage.
+      goSafe: /\brand\.Read\s*\(|\bio\.ReadFull\s*\(\s*rand\.Reader|\bcrypto\/rand\b/ },
+    // C#: a zero/static IV assigned to .IV or passed to CreateEncryptor/Decryptor.
+    { re: /\.\s*IV\s*=\s*new\s+byte\s*\[\s*\d+\s*\]/g },                              // C# aes.IV = new byte[16]
+    { re: /\bCreateEncryptor\s*\(\s*[^,]+,\s*new\s+byte\s*\[\s*\d+\s*\]/g },          // C# CreateEncryptor(key, new byte[16])
+    // PHP: openssl_encrypt with an empty-string IV or a str_repeat("\0",N) IV.
+    { re: /\bopenssl_encrypt\s*\([^;]*,\s*(?:""|''|str_repeat\s*\(\s*["']\\?0["']\s*,)/g },
+    { re: /\$iv\s*=\s*str_repeat\s*\(\s*["']\\?0["']\s*,\s*\d+\s*\)/g },
+    // Ruby: cipher.iv = a zero / fixed literal string.
+    { re: /\.\s*iv\s*=\s*["']\\x?0(?:\\x?0|0)*["']\s*\*\s*\d+/gi },                    // cipher.iv = "\x00" * 16
+    { re: /\.\s*iv\s*=\s*["'](?:\\x00){4,}["']/gi },                                  // cipher.iv = "\x00\x00…"
+    { re: /\.\s*iv\s*=\s*["'][0]{8,}["']/g },                                         // cipher.iv = "0000…"
   ];
   for (const p of patterns) {
+    // Some patterns only make sense in the presence of a companion construct
+    // (e.g. a Go `iv := make([]byte,…)` is only suspicious when a CBC/CTR/…
+    // mode constructor uses it). Skip the pattern when its gate is absent.
+    if (p.goGate && !p.goGate.test(code)) continue;
+    if (p.goSafe && p.goSafe.test(code)) continue;
     let m;
     while ((m = p.re.exec(code))) {
       const ln = _line(raw, m.index);

package/src/sast/csharp-structural.js

@@ -0,0 +1,65 @@
+// C# structural detectors — PRD Tier 1.
+//
+// The main csharp.js is flow/taint-based and misses two corpus shapes:
+//   - a hardcoded secret in a const/static field, SPLIT across concatenated
+//     literals ("sk_" + "live_…") specifically to evade secret regexes;
+//   - SSRF via WebClient/HttpClient on a non-validated URL.
+// Both are regex/structural and complement the flow engine.
+
+import { blankComments } from './_comment-strip.js';
+
+const SECRET_PREFIX = /\b(?:sk_|sk-|AKIA|ghp_|gho_|xox[abps]-|AIza|eyJ|-----BEGIN|glpat-)/;
+// A field whose name signals a credential, assigned a string (or concat of
+// string literals — the splitting trick).
+const SECRET_FIELD = /\b\w*(?:apikey|api_key|secret|token|password|passwd|pwd|credential|privatekey|connectionstring|accesskey)\w*\s*=\s*((?:"[^"]*"\s*\+\s*)*"[^"]*")/ig;
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+// Join the contents of a concatenation of string literals.
+function joinLiterals(expr) {
+  const parts = expr.match(/"([^"]*)"/g) || [];
+  return parts.map(p => p.slice(1, -1)).join('');
+}
+
+export function scanCsharpStructural(fp, raw) {
+  if (!/\.cs$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const findings = [];
+  const seen = new Set();
+  const push = (f) => { if (!seen.has(f.id)) { seen.add(f.id); findings.push(f); } };
+
+  // Hardcoded secret in a credential-named field. The joined literal value must
+  // look like a real secret (length or known prefix) so header-name constants
+  // (ApiKeyHeader = "X-Api-Key") are not flagged.
+  let m;
+  const sre = new RegExp(SECRET_FIELD.source, SECRET_FIELD.flags);
+  while ((m = sre.exec(code))) {
+    const value = joinLiterals(m[1]);
+    if (value.length < 16 && !SECRET_PREFIX.test(value)) continue;
+    const line = lineOf(code, m.index);
+    push({
+      id: `csharp-hardcoded-secret:${fp}:${line}`, file: fp, line,
+      vuln: 'Hardcoded credential in a const/static field (C#)',
+      severity: 'high', cwe: 'CWE-798', family: 'secret', parser: 'CSHARP', confidence: 0.7,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Load the secret from the environment / a secrets manager (Environment.GetEnvironmentVariable, Azure Key Vault). Concatenating the literal to split it does not help — rotate the exposed value.',
+    });
+  }
+
+  // SSRF: WebClient/HttpClient fetch from a non-literal URL, unless a host
+  // allow/deny guard is present.
+  const SSRF_SINK = /\.(?:DownloadString|DownloadData|OpenRead|GetAsync|GetStringAsync|GetStreamAsync|GetByteArrayAsync)\s*\(\s*[A-Za-z_]\w*\s*\)/;
+  const SSRF_GUARD = /169\.254\.169\.254|\.Host\b|allow(?:ed)?Hosts?|IsLoopback|deny(?:list)?|block(?:list|ed)/i;
+  if (SSRF_SINK.test(code) && !SSRF_GUARD.test(code)) {
+    const line = lineOf(code, code.search(SSRF_SINK));
+    push({
+      id: `csharp-ssrf:${fp}:${line}`, file: fp, line,
+      vuln: 'SSRF — HTTP client fetch from a non-validated URL (C#)',
+      severity: 'high', cwe: 'CWE-918', family: 'ssrf', parser: 'CSHARP', confidence: 0.55,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Validate the URL host against an allow-list and reject RFC1918 / link-local / metadata (169.254.169.254) addresses before fetching.',
+    });
+  }
+
+  return findings;
+}

package/src/sast/csharp.js

@@ -531,6 +531,9 @@ function detectOpenRedirect(file, raw, ir, analysis, out, seen) {
       // URL is non-local. We still flag it because Juliet expects the
       // detection — but downgrade the severity.
       const isLocalRedirect = call.method === 'LocalRedirect';
+      // A LocalRedirect / Redirect guarded by Url.IsLocalUrl is the documented
+      // safe pattern — don't flag it (avoids FP on hardened handlers).
+      if ((isLocalRedirect || /\bUrl\.IsLocalUrl\b/.test(raw)) && /\bUrl\.IsLocalUrl\b/.test(raw)) continue;
       const id = `csharp-open-redirect:${file}:${call.line}`;
       if (seen.has(id)) continue;
       seen.add(id);

package/src/sast/csrf.js

@@ -21,11 +21,28 @@ const STATE_CHANGE_RE = {
   django: /\b(?:require_POST|require_http_methods\s*\(\s*\[[^\]]*['"](POST|PUT|PATCH|DELETE)['"])/gi,
   fastapi: /@\w+\s*\.\s*(post|put|patch|delete)\s*\(/gi,
   spring: /@(PostMapping|PutMapping|PatchMapping|DeleteMapping)\b/g,
+  // Symfony: reading the POST body bag (`$request->request->get(...)`) is the
+  // state-change signal, plus the Route annotation method list.
+  symfony: /\$\w+\s*->\s*(?:request|getPayload\s*\(\s*\))\s*->\s*(?:get|getInt|getBoolean|getAlnum|getDigits|all|has)\s*\(|[#@]\[?\s*Route\s*\([^)]*methods\s*[:=]\s*[[{][^\]}]*['"](?:POST|PUT|PATCH|DELETE)['"]/gi,
+  // Go (gin/echo/fiber/chi/mux): a router POST/PUT/PATCH/DELETE registration,
+  // or net/http mux `.Methods("POST")`.
+  go: /\b\w+\s*\.\s*(?:POST|PUT|PATCH|DELETE)\s*\(\s*["'`]|\.\s*Methods\s*\(\s*["'](?:POST|PUT|PATCH|DELETE)["']/g,
+  // Ruby on Rails: a route declaration `post '/x'` / `patch` / `put` / `delete`
+  // (in routes.rb) or `resources :x` (full CRUD incl. state-changing verbs).
+  ruby: /^\s*(?:post|put|patch|delete)\s+['":]|\bresources\s+:/gim,
+  // C# ASP.NET MVC/Web API: a [HttpPost]/[HttpPut]/[HttpPatch]/[HttpDelete]
+  // action attribute.
+  csharp: /\[\s*Http(?:Post|Put|Patch|Delete)\b/g,
 };
 
-const CSRF_DEFENCE_RE = /\b(?:csurf|csrfProtection|csrf\(\)|express-csrf-token|lusca\.csrf|fastify-csrf|CSRFProtect|csrf_protect|CsrfViewMiddleware|CsrfFilter|@CsrfProtected|sameSite\s*[:=]\s*['"](?:Strict|Lax)['"]|origin\s*===|referer\s*===|Origin\s*===|Referer\s*===)/i;
+const CSRF_DEFENCE_RE = /\b(?:csurf|csrfProtection|csrf\(\)|express-csrf-token|lusca\.csrf|fastify-csrf|CSRFProtect|csrf_protect|CsrfViewMiddleware|CsrfFilter|@CsrfProtected|isCsrfTokenValid|IsCsrfTokenValid|csrf_token|CsrfToken|ValidateAntiForgeryToken|AutoValidateAntiforgeryToken|IAntiforgery|protect_from_forgery|verify_authenticity_token|form_authenticity_token|gorilla\/csrf|csrf\.Protect|nosurf|sameSite\s*[:=]\s*['"](?:Strict|Lax)['"]|origin\s*===|referer\s*===|Origin\s*===|Referer\s*===)/i;
 
-const TOKEN_AUTH_RE = /\b(?:Authorization\s*:\s*Bearer|\.startsWith\s*\(\s*['"`]Bearer|req\.headers\.authorization|request\.headers\.get\(\s*['"`]authorization|bearer\s+token|x-api-key|verifyJWT|jwt\.verify|jsonwebtoken)/i;
+// Token-auth signals — these auth schemes are CSRF-safe by construction (the
+// credential rides in a header the browser never auto-attaches). NOTE: bare
+// `[Authorize]` is intentionally NOT here — ASP.NET cookie auth is the default
+// and stays CSRF-vulnerable; only an explicit Bearer scheme or [ApiController]
+// (which disables antiforgery + implies token auth) exempts.
+const TOKEN_AUTH_RE = /\b(?:Authorization\s*:\s*Bearer|\.startsWith\s*\(\s*['"`]Bearer|req\.headers\.authorization|request\.headers\.get\(\s*['"`]authorization|bearer\s+token|x-api-key|verifyJWT|jwt\.verify|jsonwebtoken|lexik_jwt|JWTTokenAuthenticator|headers\s*->\s*get\s*\(\s*['"]Authorization|c\.GetHeader\s*\(\s*["']Authorization|request\.headers\[["']Authorization)|\[\s*ApiController\b|AuthenticationSchemes\s*=\s*["']?Bearer/i;
 
 const TEST_FILE_RE = /(?:^|\/)(?:tests?|__tests__|specs?|test|fixtures)\//i;
 
@@ -39,9 +56,13 @@ export function scanCSRF(fp, raw) {
   if (/^(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(ext)) langSel = ['express', 'fastify'];
   else if (ext === 'py') langSel = ['flask', 'django', 'fastapi'];
   else if (ext === 'java' || ext === 'kt') langSel = ['spring'];
+  else if (ext === 'php' || ext === 'phtml') langSel = ['symfony'];
+  else if (ext === 'go') langSel = ['go'];
+  else if (ext === 'rb') langSel = ['ruby'];
+  else if (ext === 'cs') langSel = ['csharp'];
   if (!langSel) return [];
 
-  const code = blankComments(raw, ext === 'py' ? 'py' : undefined);
+  const code = blankComments(raw, (ext === 'py' || ext === 'rb') ? 'py' : undefined);
   // Project-wide-ish: if the file shows CSRF defence anywhere or only handles
   // token-authenticated routes, we suppress.
   const csrfInScope = CSRF_DEFENCE_RE.test(code);

package/src/sast/csv-injection.js

@@ -0,0 +1,84 @@
+// CSV / formula injection (CWE-1236) — additive detector.
+//
+// When user-controlled text is written into a CSV/spreadsheet cell that begins
+// with `=`, `+`, `-`, `@`, or a tab/CR, a spreadsheet app (Excel, Sheets,
+// LibreOffice) interprets it as a FORMULA on open — enabling data exfiltration
+// (`=IMPORTXML(...)`), command execution via DDE, or credential phishing. The
+// fix is to neutralize the leading character (prefix with `'`), not HTML/SQL
+// escaping.
+//
+// High precision by construction: we only fire when (a) a CSV/spreadsheet
+// WRITE API is on the line, (b) a user-derived value is referenced on the same
+// statement, and (c) no formula-neutralization helper is present nearby.
+
+import { blankComments } from './_comment-strip.js';
+
+const JS_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const PY_RE = /\.py$/i;
+
+// CSV / spreadsheet write APIs worth flagging (JS + Python).
+const CSV_WRITE = [
+  /\bwriteRecords?\s*\(/,                 // csv-writer createObjectCsvWriter().writeRecords
+  /\bcsv\s*\.\s*stringify\s*\(/,          // csv-stringify
+  /\bstringify\s*\(\s*[^)]*\bcolumns\b/,  // csv-stringify with columns
+  /\bcsvStringify\s*\(/,
+  /\b(?:fastcsv|fast_csv|csvFormat)\s*\(/,
+  /\bXLSX\s*\.\s*utils\s*\.\s*(?:json_to_sheet|aoa_to_sheet|sheet_add)/,
+  /\bwriterow\s*\(|\bwriterows\s*\(|\bwriteheader\s*\(/,   // python csv module
+  /\bcsv\s*\.\s*writer\s*\(/,
+  /\bDictWriter\s*\(/,
+];
+
+// User-derived value hints on the same statement.
+const TAINT_HINT =
+  /\b(?:req\.|request\.|params\.|query\.|body\.|_GET|_POST|_REQUEST|getParameter|\.get\(|user\.|profile\.|\.fields\b|row\.|record\.)/;
+
+// Formula-neutralization already applied → suppress.
+const NEUTRALIZED =
+  /escapeFormula|sanitizeCsv|sanitiseCsv|csvEscape|formulaEscape|stripFormula|['"`]\s*'\s*['"`]\s*\+|startsWith\(\s*['"`][=+\-@]|replace\(\s*\/\^\[=/;
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+export function scanCsvInjection(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  const isJs = JS_RE.test(fp), isPy = PY_RE.test(fp);
+  if (!isJs && !isPy) return [];
+  // Cheap pre-filter.
+  if (!/csv|writeRecords|XLSX|writerow|DictWriter|stringify/i.test(raw)) return [];
+
+  const code = blankComments(raw, isPy ? 'py' : undefined);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!CSV_WRITE.some(re => re.test(line))) continue;
+    if (!TAINT_HINT.test(line)) continue;
+    // Look at the line plus a small window for an explicit neutralizer.
+    const lo = Math.max(0, i - 4);
+    const near = lines.slice(lo, i + 2).join('\n');
+    if (NEUTRALIZED.test(near)) continue;
+    if (seen.has(i + 1)) continue;
+    seen.add(i + 1);
+    findings.push({
+      id: `csv-injection:${fp}:${i + 1}`,
+      severity: 'medium',
+      file: fp,
+      line: i + 1,
+      vuln: 'CSV / formula injection (untrusted data written to a spreadsheet cell)',
+      cwe: 'CWE-1236',
+      family: 'injection',
+      parser: 'SAST',
+      confidence: 0.55,
+      description:
+        'User-controlled text is written to a CSV/spreadsheet without neutralizing leading formula ' +
+        'characters (= + - @ tab). A spreadsheet app will execute it as a formula on open, enabling ' +
+        'data exfiltration (e.g. =IMPORTXML), DDE command execution, or phishing.',
+      remediation:
+        "Prefix any cell value that starts with = + - @ or a tab/CR with a single quote (or strip it), " +
+        'using a dedicated CSV-escaping helper. HTML/SQL escaping does not address this.',
+    });
+  }
+  return findings;
+}