@clear-capabilities/agentic-security-scanner 0.86.0 → 0.118.2

package/src/sast/frontend-hygiene.js

@@ -0,0 +1,106 @@
+// Front-end security hygiene — additive, high-precision client-side checks
+// that the engine did not previously cover. None of these change existing
+// findings; each emits its own finding class.
+//
+//   1. Reverse tabnabbing (CWE-1022): `<a target="_blank">` without
+//      `rel="noopener"` — the opened page can rewrite `window.opener.location`
+//      and phish. (Modern browsers default to noopener, so: low.)
+//   2. Missing Subresource Integrity (CWE-353): a cross-origin
+//      `<script src="https://cdn…">` / `<link rel=stylesheet href="//…">`
+//      with no `integrity=` — a compromised/MITM'd CDN executes in your origin.
+//   3. Angular sanitizer bypass (CWE-79): `DomSanitizer.bypassSecurityTrust*`
+//      with a non-literal argument explicitly disables Angular's built-in XSS
+//      protection on attacker-influenced data.
+
+import { blankComments } from './_comment-strip.js';
+
+const MARKUP_RE = /\.(?:html?|jsx|tsx|vue|svelte|php|erb|ejs|hbs|handlebars|astro)$/i;
+const SCRIPT_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs)$/i;
+
+const A_BLANK_RE   = /<a\b[^>]*\btarget\s*=\s*["']_blank["'][^>]*>/gi;
+const REL_NOOPENER = /\brel\s*=\s*["'][^"']*\bno(?:opener|referrer)\b/i;
+
+const EXT_SCRIPT_RE = /<script\b[^>]*\bsrc\s*=\s*["'](?:https?:)?\/\/[^"']+["'][^>]*>/gi;
+const EXT_LINK_RE   = /<link\b[^>]*\bhref\s*=\s*["'](?:https?:)?\/\/[^"']+["'][^>]*>/gi;
+const HAS_INTEGRITY = /\bintegrity\s*=/i;
+const IS_STYLESHEET = /\brel\s*=\s*["'][^"']*\bstylesheet\b/i;
+
+const NG_BYPASS_RE = /\.bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(\s*([^)]*?)\)/g;
+// A pure string literal argument is a developer-controlled constant — safe.
+const PURE_LITERAL = /^\s*(['"`])(?:\\.|(?!\1).)*\1\s*$/;
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+export function scanFrontendHygiene(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  const isMarkup = MARKUP_RE.test(fp);
+  const isScript = SCRIPT_RE.test(fp);
+  if (!isMarkup && !isScript) return [];
+
+  const findings = [];
+
+  if (isMarkup) {
+    // 1. Reverse tabnabbing.
+    A_BLANK_RE.lastIndex = 0;
+    let m;
+    while ((m = A_BLANK_RE.exec(raw))) {
+      if (REL_NOOPENER.test(m[0])) continue;
+      findings.push({
+        id: `tabnabbing:${fp}:${lineOf(raw, m.index)}`,
+        severity: 'low', file: fp, line: lineOf(raw, m.index),
+        vuln: 'Reverse tabnabbing (target="_blank" without rel="noopener")',
+        cwe: 'CWE-1022', family: 'client-side', parser: 'SAST',
+        description: 'A link opens a new tab with target="_blank" but no rel="noopener". The destination page receives a reference to window.opener and can redirect this tab to a phishing page.',
+        remediation: 'Add rel="noopener noreferrer" (or rel="noopener") to every target="_blank" link.',
+      });
+    }
+    // 2. Missing SRI on cross-origin <script>.
+    EXT_SCRIPT_RE.lastIndex = 0;
+    while ((m = EXT_SCRIPT_RE.exec(raw))) {
+      if (HAS_INTEGRITY.test(m[0])) continue;
+      findings.push({
+        id: `missing-sri-script:${fp}:${lineOf(raw, m.index)}`,
+        severity: 'medium', file: fp, line: lineOf(raw, m.index),
+        vuln: 'Missing Subresource Integrity on cross-origin <script>',
+        cwe: 'CWE-353', family: 'supply-chain', parser: 'SAST',
+        description: 'A script is loaded from a third-party origin without an integrity= hash. If that host (or a CDN in front of it) is compromised or MITM\'d, arbitrary code runs in your origin.',
+        remediation: 'Add an integrity="sha384-…" attribute and crossorigin="anonymous", or self-host the asset.',
+      });
+    }
+    // 2b. Missing SRI on cross-origin stylesheet <link>.
+    EXT_LINK_RE.lastIndex = 0;
+    while ((m = EXT_LINK_RE.exec(raw))) {
+      if (!IS_STYLESHEET.test(m[0])) continue;
+      if (HAS_INTEGRITY.test(m[0])) continue;
+      findings.push({
+        id: `missing-sri-link:${fp}:${lineOf(raw, m.index)}`,
+        severity: 'low', file: fp, line: lineOf(raw, m.index),
+        vuln: 'Missing Subresource Integrity on cross-origin stylesheet',
+        cwe: 'CWE-353', family: 'supply-chain', parser: 'SAST',
+        description: 'A stylesheet is loaded from a third-party origin without an integrity= hash, so a compromised CDN can inject CSS-based exfiltration / UI redress.',
+        remediation: 'Add integrity="sha384-…" + crossorigin="anonymous", or self-host the stylesheet.',
+      });
+    }
+  }
+
+  if (isScript) {
+    // 3. Angular sanitizer bypass with a non-literal argument.
+    const code = blankComments(raw);
+    NG_BYPASS_RE.lastIndex = 0;
+    let m;
+    while ((m = NG_BYPASS_RE.exec(code))) {
+      const arg = (m[1] || '').trim();
+      if (!arg || PURE_LITERAL.test(arg)) continue; // constant → safe
+      findings.push({
+        id: `ng-sanitizer-bypass:${fp}:${lineOf(code, m.index)}`,
+        severity: 'high', file: fp, line: lineOf(code, m.index),
+        vuln: 'Angular sanitizer bypass on dynamic value (bypassSecurityTrust*)',
+        cwe: 'CWE-79', family: 'xss', parser: 'SAST',
+        description: 'DomSanitizer.bypassSecurityTrust* explicitly disables Angular\'s built-in XSS protection. Called on a non-constant value, attacker-influenced data reaches the DOM unsanitized.',
+        remediation: 'Avoid bypassSecurityTrust* on dynamic data; bind trusted values only, or sanitize with DomSanitizer.sanitize() / a strict allow-list first.',
+      });
+    }
+  }
+
+  return findings;
+}

package/src/sast/go-structural.js

@@ -0,0 +1,60 @@
+// Go structural (taint-independent) injection detectors — PRD Tier 1 (Go recall).
+//
+// Go handler FNs: user input from c.Query / r.URL.Query().Get is built into a
+// sink via fmt.Sprintf or string concat (Go has no string templates). That
+// shape is the vulnerability regardless of variable names. Parameterized
+// queries (`db.Query("… ?", x)`) and canonicalized paths have no Sprintf/concat
+// in the sink argument, so they don't match.
+
+import { blankComments } from './_comment-strip.js';
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+export function scanGoStructural(fp, raw) {
+  if (!/\.go$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const findings = [];
+  const seen = new Set();
+  const emit = (key, line, meta) => {
+    const id = `go-struct-${key}:${fp}:${line}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line, vuln: meta.vuln, severity: meta.severity, cwe: meta.cwe,
+      family: meta.family, parser: 'GO', confidence: meta.confidence ?? 0.72,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200), remediation: meta.remediation,
+    });
+  };
+
+  // SQL injection: a database/sql query method built with fmt.Sprintf or concat.
+  const SQL_RE = /\.(?:Query|QueryRow|QueryContext|QueryRowContext|Exec|ExecContext|Prepare|PrepareContext)\s*\(\s*(?:fmt\.Sprintf\s*\(|"[^"\n]*"\s*\+)/g;
+  let m;
+  while ((m = SQL_RE.exec(code))) emit('sqli', lineOf(code, m.index), {
+    vuln: 'SQL Injection — query built with fmt.Sprintf / concat (Go)',
+    severity: 'critical', cwe: 'CWE-89', family: 'sql-injection', confidence: 0.75,
+    remediation: 'Use parameter placeholders: db.Query("… WHERE name = ?", name). Never build SQL with fmt.Sprintf or string concatenation.',
+  });
+
+  // Path traversal: an os/ioutil file op built with concat or fmt.Sprintf.
+  const PATH_RE = /\b(?:os\.Open|os\.OpenFile|os\.ReadFile|os\.Create|ioutil\.ReadFile|ioutil\.WriteFile)\s*\(\s*(?:"[^"\n]*"\s*\+|fmt\.Sprintf\s*\()/g;
+  while ((m = PATH_RE.exec(code))) emit('path', lineOf(code, m.index), {
+    vuln: 'Path Traversal — file path built with concat / fmt.Sprintf (Go)',
+    severity: 'high', cwe: 'CWE-22', family: 'path-traversal', confidence: 0.7,
+    remediation: 'Strip the path with filepath.Base and assert containment: want := filepath.Join(base, filepath.Base(name)); if !strings.HasPrefix(filepath.Clean(want), base) { reject }.',
+  });
+
+  // Insecure deserialization: encoding/gob decoding attacker-controlled bytes
+  // into an interface{} / any target — gob will instantiate registered concrete
+  // types, a deserialization gadget surface. Gated on encoding/gob being used.
+  if (/\bencoding\/gob\b|\bgob\.NewDecoder\b/.test(code)) {
+    const GOB_RE = /\bgob\.NewDecoder\s*\([\s\S]*?\)\s*\.\s*Decode\s*\(|\b\w+\s*:?=\s*gob\.NewDecoder\s*\(/g;
+    while ((m = GOB_RE.exec(code))) emit('gob-deser', lineOf(code, m.index), {
+      vuln: 'Insecure Deserialization — encoding/gob decoding untrusted input (Go)',
+      severity: 'high', cwe: 'CWE-502', family: 'insecure-deserialization', confidence: 0.6,
+      remediation: 'Do not gob-decode data from an untrusted source — gob instantiates registered concrete types and is not designed for adversarial input. Use a schema-validated format (JSON with a fixed struct, protobuf) and validate before use.',
+    });
+  }
+
+  return findings;
+}

package/src/sast/java-structural.js

@@ -0,0 +1,81 @@
+// Java structural (taint-independent) injection detectors — PRD Tier 1.
+//
+// The flow-based Java modules miss standalone DAO/handler methods whose
+// tainted-by-convention parameter has no in-file source. Java has no string
+// templates, so the injection shape is string CONCATENATION (`"…" +`) into a
+// dangerous sink — which is itself the vulnerability regardless of the
+// variable's name. Parameterized statements / canonicalized paths / host-
+// guarded URLs do not match, keeping this high-precision.
+
+import { blankComments } from './_comment-strip.js';
+
+// Concat-into-sink families with no guard needed (parameterized form has no
+// string-concat argument, so it auto-clears).
+const RE = {
+  sqlInjection: /\b(?:executeQuery|executeUpdate|execute|createQuery|createNativeQuery|prepareStatement|prepareCall)\s*\(\s*"[^"\n]*"\s*\+/g,
+  cmdInjection: /\b(?:Runtime\.getRuntime\(\)\s*\.\s*exec|ProcessBuilder)\s*\(\s*(?:new\s+String\s*\[\s*\]\s*\{\s*)?"[^"\n]*"\s*\+/g,
+};
+
+const META = {
+  sqlInjection: {
+    vuln: 'SQL Injection — query built with string concatenation (Java)',
+    severity: 'critical', cwe: 'CWE-89',
+    remediation: 'Use a PreparedStatement with bind parameters: prepareStatement("… WHERE name = ?") then setString(1, name). Never concatenate values into SQL.',
+  },
+  cmdInjection: {
+    vuln: 'Command Injection — exec built with string concatenation (Java)',
+    severity: 'critical', cwe: 'CWE-78',
+    remediation: 'Use ProcessBuilder with an argument array (no shell): new ProcessBuilder("cmd", arg1, arg2). Never concatenate input into a command string.',
+  },
+};
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+export function scanJavaStructural(fp, raw) {
+  if (!/\.java$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const findings = [];
+  const seen = new Set();
+  const push = (f) => { if (!seen.has(f.id)) { seen.add(f.id); findings.push(f); } };
+  const emit = (key, line, meta) => push({
+    id: `java-struct-${key}:${fp}:${line}`, file: fp, line,
+    vuln: meta.vuln, severity: meta.severity, cwe: meta.cwe, family: meta.family,
+    snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+    remediation: meta.remediation, parser: 'JAVA', confidence: 0.78,
+  });
+
+  for (const [key, re] of Object.entries(RE)) {
+    const r = new RegExp(re.source, re.flags);
+    let m;
+    while ((m = r.exec(code))) emit(key, lineOf(code, m.index), META[key]);
+  }
+
+  // Path traversal (CWE-22): a file path built by concatenation, unless the
+  // file canonicalizes / normalizes / range-checks the path.
+  const PATH_SINK = /\bnew\s+(?:File|FileInputStream|FileReader|FileOutputStream|RandomAccessFile)\s*\(\s*"[^"\n]*"\s*\+|\bPaths\.get\s*\(\s*"[^"\n]*"\s*\+/;
+  const PATH_GUARD = /getCanonicalPath|toRealPath|\.normalize\s*\(\s*\)|\bstartsWith\s*\(|FilenameUtils|\.isAbsolute\s*\(/;
+  if (PATH_SINK.test(code) && !PATH_GUARD.test(code)) {
+    const line = lineOf(code, code.search(PATH_SINK));
+    emit('path', line, {
+      vuln: 'Path Traversal — file path built with string concatenation (Java)',
+      severity: 'high', cwe: 'CWE-22',
+      remediation: 'Resolve against an allow-listed base and verify containment: Path want = base.resolve(name).normalize().toRealPath(); if (!want.startsWith(base)) throw …',
+    });
+  }
+
+  // SSRF (CWE-918): new URL/URI opened from a non-literal/templated value,
+  // unless a host allow/deny guard is present.
+  const SSRF_SINK = /\bnew\s+(?:URL|URI)\s*\(\s*(?:[A-Za-z_]\w*\s*\)|"[^"\n]*"\s*\+)/;
+  const SSRF_GUARD = /169\.254\.169\.254|getHost\s*\(\s*\)|allow(?:ed)?Hosts?|isLoopback|isSiteLocal|isLinkLocal|InetAddress|\bDENY\b|deny(?:list)?|block(?:list|ed)/i;
+  if (SSRF_SINK.test(code) && !SSRF_GUARD.test(code)) {
+    const line = lineOf(code, code.search(SSRF_SINK));
+    emit('ssrf', line, {
+      vuln: 'SSRF — URL/URI opened from a non-literal value (Java)',
+      severity: 'high', cwe: 'CWE-918',
+      remediation: 'Resolve the host and reject RFC1918 / link-local / metadata (169.254.169.254) addresses, or use an allow-list, before opening the connection.',
+    });
+  }
+
+  return findings;
+}

package/src/sast/js-framework-structural.js

@@ -0,0 +1,115 @@
+// JS/TS framework structural detectors — PRD Tier 1 (JS/Python recall).
+//
+// The weakest languages (JS/Python) miss framework-handler shapes where user
+// input arrives via a framework source (@Query, ctx.query, req.query) and is
+// concatenated into a sink. Taint-independent structural rules close them.
+// SSRF/path findings (CWE-918/CWE-22) are emitted here too; the centralized
+// guard pass (engine.js dropGuardedFindings) handles their hardened forms.
+
+import { blankComments } from './_comment-strip.js';
+
+const JS_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+// Skip an XSS finding when the value is HTML-escaped on the same line.
+const XSS_ESCAPE = /\b(?:escape|escapeHtml|escape_html|sanitize|sanitizeHtml|DOMPurify\.sanitize|he\.encode|he\.escape|_\.escape|encodeURIComponent|xss)\s*\(/;
+// Skip prototype pollution when the file filters forbidden keys.
+const PROTO_GUARD = /(?:__proto__|constructor|prototype|FORBIDDEN_KEYS|DANGEROUS_KEYS|blocked?Keys)\b[\s\S]{0,80}?(?:continue|delete|\.has\s*\(|new\s+Set|\.includes\s*\(|skip|filter|reject|block|throw|return)/;
+
+export function scanJsFrameworkStructural(fp, raw) {
+  if (!JS_RE.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+  const emit = (key, line, meta) => {
+    const id = `js-fw-${key}:${fp}:${line}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line, vuln: meta.vuln, severity: meta.severity, cwe: meta.cwe,
+      family: meta.family, parser: 'JS-FW', confidence: meta.confidence ?? 0.7,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200), remediation: meta.remediation,
+    });
+  };
+
+  // True when `idx` falls inside a string literal on its own line — i.e. an odd
+  // number of unescaped quotes of some kind precede it. Used to skip a `.query(`
+  // that is itself the CONTENT of a string (e.g. a rule-definition's
+  // `example: "db.query(\`…\`)"`), which is data, not a call.
+  const _insideStringLiteral = (idx) => {
+    const lineStart = code.lastIndexOf('\n', idx - 1) + 1;
+    const prefix = code.slice(lineStart, idx);
+    for (const q of ['"', "'"]) {
+      const n = (prefix.match(new RegExp(`(?<!\\\\)${q}`, 'g')) || []).length;
+      if (n % 2 === 1) return true;
+    }
+    return false;
+  };
+
+  // SQL Injection: db.query/.execute/.raw with template-literal ${} or concat.
+  // (TypeORM Connection.query, mysql connection.query, etc.)
+  const SQL_RE = /\.(?:query|execute|raw|prepare)\s*\(\s*(?:`[^`\n]*\$\{|"[^"\n]*"\s*\+|'[^'\n]*'\s*\+|"[^"\n]*\$\{)/g;
+  let m;
+  while ((m = SQL_RE.exec(code))) {
+    if (_insideStringLiteral(m.index)) continue;
+    emit('sqli', lineOf(code, m.index), {
+      vuln: 'SQL Injection — query built with template literal / concat (JS/TS)',
+      severity: 'critical', cwe: 'CWE-89', family: 'sql-injection', confidence: 0.75,
+      remediation: 'Use parameterized queries — pass `?`/`$1` placeholders and a values array (e.g. `conn.query("… WHERE name = ?", [name])`). Never interpolate or concatenate values into SQL.',
+    });
+  }
+
+  // NestJS / axios HttpService SSRF: http(.|Service|Client).get(<non-literal>).
+  const SSRF_RE = /\b(?:http|httpService|httpClient|axios)\s*\.\s*(?:get|post|put|patch|delete|request)\s*\(\s*[A-Za-z_$][\w$.]*\s*[),]/g;
+  while ((m = SSRF_RE.exec(code))) emit('ssrf', lineOf(code, m.index), {
+    vuln: 'SSRF — HTTP client request to a non-literal URL (JS/TS)',
+    severity: 'high', cwe: 'CWE-918', family: 'ssrf', confidence: 0.55,
+    remediation: 'Validate the URL host against an allow-list and reject RFC1918 / link-local / metadata (169.254.169.254) addresses before requesting.',
+  });
+
+  // Koa path traversal: koa-send with a user-controlled path.
+  const KOA_PATH_RE = /\bsend\s*\(\s*ctx\s*,\s*ctx\s*\.\s*(?:query|params|request)\b/g;
+  while ((m = KOA_PATH_RE.exec(code))) emit('koa-path', lineOf(code, m.index), {
+    vuln: 'Path Traversal — koa-send with user-controlled path',
+    severity: 'high', cwe: 'CWE-22', family: 'path-traversal', confidence: 0.6,
+    remediation: 'Resolve against an allow-listed root and reject paths that escape it; koa-send `root` alone does not stop `..` in all versions. Use `path.basename` or a canonicalize+containment check.',
+  });
+
+  // Koa reflected XSS: ctx.body assigned from ctx.query/params (unless escaped).
+  const KOA_XSS_RE = /ctx\s*\.\s*body\s*=\s*([^;\n]*\bctx\s*\.\s*(?:query|params|request)\b[^;\n]*)/g;
+  while ((m = KOA_XSS_RE.exec(code))) {
+    if (XSS_ESCAPE.test(m[1])) continue;
+    emit('koa-xss', lineOf(code, m.index), {
+      vuln: 'Reflected XSS — ctx.body built from user input without encoding (Koa)',
+      severity: 'high', cwe: 'CWE-79', family: 'xss', confidence: 0.65,
+      remediation: 'HTML-encode user input before placing it in the response body (e.g. `escape-html`), or render via a template engine with auto-escaping.',
+    });
+  }
+
+  // XXE: libxmljs parse with entity expansion / DTD loading enabled
+  // (`noent: true`, `dtdload: true`, `replaceEntities: true`). These options
+  // turn an external-entity reference in attacker XML into file read / SSRF.
+  const XXE_RE = /\bparse(?:XmlString|Xml|FromString|XmlAsync)?\s*\([^)]*\b(?:noent|dtdload|dtdvalid|replaceEntities|external|expandEntities)\s*:\s*(?:true|1)\b/g;
+  while ((m = XXE_RE.exec(code))) emit('xxe', lineOf(code, m.index), {
+    vuln: 'XXE — XML parsed with entity expansion / DTD loading enabled (libxmljs)',
+    severity: 'high', cwe: 'CWE-611', family: 'xxe', confidence: 0.7,
+    remediation: 'Parse with entity expansion and DTD loading OFF — drop `noent`/`dtdload`/`replaceEntities` (they default to false). Untrusted XML with external entities enabled allows local file read and SSRF.',
+  });
+
+  // Prototype pollution: a deep-merge/extend of req/ctx user input, unless the
+  // file filters __proto__/constructor/prototype keys.
+  const PROTO_RE = /\b(?:deepMerge|deepExtend|mergeDeep|defaultsDeep|mergeWith|_\.merge|merge|extend|assignIn)\s*\([^)\n]*\b(?:req|request|ctx)\s*\.\s*(?:body|query|params)\b/g;
+  const fileFiltersProto = PROTO_GUARD.test(code);
+  while ((m = PROTO_RE.exec(code))) {
+    if (fileFiltersProto) continue;
+    emit('proto', lineOf(code, m.index), {
+      vuln: 'Prototype Pollution — user input deep-merged without key filtering',
+      severity: 'critical', cwe: 'CWE-1321', family: 'prototype-pollution', confidence: 0.6,
+      remediation: 'Reject `__proto__`, `constructor`, and `prototype` keys before merging, or use a Map / Object.create(null) / structuredClone. Avoid merging request bodies into existing objects.',
+    });
+  }
+
+  return findings;
+}

package/src/sast/kotlin.js

@@ -18,6 +18,15 @@ const RE = {
   exec: /\bRuntime\.getRuntime\(\)\s*\.\s*exec\s*\(\s*[^)]*\b(?:request|req|input|params|userInput)\b/g,
   gsonPolymorphic: /\bGson\(\)\s*\.\s*fromJson\s*\(\s*[^,)]+,\s*(?:Any::class|Object::class)/g,
   fileReadText: /\bFile\s*\(\s*[^)]*\b(?:request|req|input|userInput|params)\b[^)]*\)\s*\.\s*read(?:Text|Bytes|Lines)/g,
+  // Structural (taint-independent) detectors: a dangerous sink built with a
+  // Kotlin string template (`${x}` / `$x`) or string concatenation (`"…" +`)
+  // is the injection shape regardless of the variable's name — parameterized
+  // queries / array-form exec / canonicalized paths never interpolate. A pure
+  // string literal (no template, no concat) does NOT match, so this stays
+  // high-precision and complements the taint engine (which needs a source).
+  sqlInjection: /\b(?:executeQuery|executeUpdate|prepareStatement|prepareCall|createQuery|createNativeQuery|nativeQuery|rawQuery)\s*\(\s*"[^"\n]*(?:\$\{?[A-Za-z_]|"\s*\+)/g,
+  cmdInjectionStructural: /\b(?:Runtime\.getRuntime\(\)\s*\.\s*exec|ProcessBuilder)\s*\(\s*(?:listOf\s*\(\s*)?"[^"\n]*(?:\$\{?[A-Za-z_]|"\s*\+)/g,
+  pathTraversalStructural: /\b(?:File|FileInputStream|FileReader|FileOutputStream|RandomAccessFile|Paths\.get)\s*\(\s*"[^"\n]*(?:\$\{?[A-Za-z_]|"\s*\+)/g,
 };
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -66,6 +75,21 @@ export function scanKotlin(fp, raw) {
           severity: 'high', cwe: 'CWE-22',
           remediation: 'Canonicalize and verify the path is within an allowed base directory before reading: `if (!File(path).canonicalPath.startsWith(baseDir.canonicalPath)) throw ...`. Better: store files by content-hash filenames generated server-side and let the client request by hash, never by user-supplied path.',
         },
+        sqlInjection: {
+          vuln: 'SQL Injection — query built with a Kotlin string template / concat (Kotlin)',
+          severity: 'critical', cwe: 'CWE-89',
+          remediation: 'Use a parameterized query: `prepareStatement("… WHERE name = ?")` then `setString(1, name)`. Never interpolate (`${…}`) or concatenate untrusted values into SQL.',
+        },
+        cmdInjectionStructural: {
+          vuln: 'Command Injection — exec built with a string template / concat (Kotlin)',
+          severity: 'critical', cwe: 'CWE-78',
+          remediation: 'Use `ProcessBuilder(listOf("cmd", arg1, arg2))` (array form) so no shell parses the string. Never concatenate or interpolate input into a command string.',
+        },
+        pathTraversalStructural: {
+          vuln: 'Path Traversal — file path built with a string template / concat (Kotlin)',
+          severity: 'high', cwe: 'CWE-22',
+          remediation: 'Canonicalize and assert the path stays within an allow-listed base dir before opening: `require(File(base, name).canonicalPath.startsWith(File(base).canonicalPath))`. Do not interpolate untrusted segments into a path.',
+        },
       }[key];
       push({
         id: `kotlin-${key}:${fp}:${line}`,
@@ -78,5 +102,53 @@ export function scanKotlin(fp, raw) {
       });
     }
   }
+  // XXE (CWE-611): an XML factory that parses without DTD/external-entity
+  // hardening. Flag only when no secure-processing config is present anywhere
+  // in the file (so the fixed form with setFeature(...) is not flagged).
+  const XXE_FACTORY = /\b(?:DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|SAXReader|XMLReaderFactory|TransformerFactory)\b/;
+  const XXE_PARSE = /\.(?:parse|newDocumentBuilder|newSAXParser|createXMLStreamReader|read)\s*\(/;
+  const XXE_GUARD = /setFeature|disallow-doctype-decl|external-general-entities|external-parameter-entities|FEATURE_SECURE_PROCESSING|setExpandEntityReferences\s*\(\s*false|ACCESS_EXTERNAL_DTD|XMLConstants/i;
+  if (XXE_FACTORY.test(code) && XXE_PARSE.test(code) && !XXE_GUARD.test(code)) {
+    const idx = code.search(XXE_FACTORY);
+    const line = lineOf(code, idx);
+    push({
+      id: `kotlin-xxe:${fp}:${line}`, file: fp, line,
+      vuln: 'XXE — XML parser without DTD/external-entity hardening (Kotlin)',
+      severity: 'high', cwe: 'CWE-611',
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Disable DTDs/external entities: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) and external-general-entities=false, or set XMLConstants.FEATURE_SECURE_PROCESSING.',
+      parser: 'KOTLIN', confidence: 0.6,
+    });
+  }
+  // SSRF (CWE-918): URL/URI opened from a non-literal or templated value,
+  // unless a host-validation guard (allow/deny-list, RFC1918/metadata check)
+  // is present in the file — the fixed form keeps URL(var) but adds the check.
+  const SSRF_SINK = /\b(?:URL|URI|HttpURLConnection)\s*\(\s*(?:"[^"\n]*\$\{?[A-Za-z_]|[A-Za-z_]\w*\s*\))/;
+  const SSRF_GUARD = /\.host\b[^\n]*\b(?:in|!in)\b|allow(?:ed)?Hosts?|isLoopback|isSiteLocal|isLinkLocal|169\.254\.169\.254|require\s*\([^)]*\bhost\b|InetAddress|block(?:list|ed)|denylist/i;
+  if (SSRF_SINK.test(code) && !SSRF_GUARD.test(code)) {
+    const idx = code.search(SSRF_SINK);
+    const line = lineOf(code, idx);
+    push({
+      id: `kotlin-ssrf:${fp}:${line}`, file: fp, line,
+      vuln: 'SSRF — URL/URI opened from a non-literal or templated value (Kotlin)',
+      severity: 'high', cwe: 'CWE-918',
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Resolve the host and reject RFC1918 / link-local / metadata (169.254.169.254) addresses before opening the connection, or restrict to an allow-list of hosts.',
+      parser: 'KOTLIN', confidence: 0.55,
+    });
+  }
+  // Insecure deserialization (CWE-502): native ObjectInputStream.readObject.
+  if (/\bObjectInputStream\s*\(/.test(code) && /\.\s*readObject\s*\(/.test(code)) {
+    const idx = code.search(/\bObjectInputStream\s*\(/);
+    const line = lineOf(code, idx);
+    push({
+      id: `kotlin-deser:${fp}:${line}`, file: fp, line,
+      vuln: 'Insecure Deserialization — ObjectInputStream.readObject on untrusted data (Kotlin)',
+      severity: 'high', cwe: 'CWE-502',
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Never deserialize untrusted data with native Java/Kotlin serialization. Use a typed format (kotlinx.serialization, Jackson with a fixed type, protobuf); if unavoidable, install a strict ObjectInputFilter allow-list.',
+      parser: 'KOTLIN', confidence: 0.6,
+    });
+  }
   return findings;
 }

package/src/sast/ldap-injection.js

@@ -12,33 +12,82 @@ import { blankComments } from './_comment-strip.js';
 //   - Python ldap3:   conn.search(base, "(uid=" + name + ")")
 //   - Python python-ldap: conn.search_s(base, scope, "(uid=" + name + ")")
 //   - Python f-strings: conn.search_s(base, scope, f"(uid={name})")
+//   - PHP:            ldap_search($ds, $base, "(uid=" . $u . ")")
+//   - Go (go-ldap):   ldap.NewSearchRequest(base, ..., "(uid="+u+")", ...)
+//   - C# DirectorySearcher: ds.Filter = "(uid=" + u + ")"   (also $"(uid={u})")
+//   - Ruby (net-ldap): conn.search(filter: "(uid=#{u})")
+//   - Kotlin JNDI:    ctx.search(base, "(uid=" + u + ")")
 //
 // We require an LDAP context hint in the file (DirContext, javax.naming,
-// ldap.initialize, ldapjs, etc.) so we don't fire on every `"foo=" + bar`
-// concatenation in unrelated code.
+// ldap.initialize, ldapjs, ldap_search, go-ldap, DirectorySearcher, Net::LDAP,
+// etc.) so we don't fire on every `"foo=" + bar` concatenation in unrelated
+// code.
 
+// LDAP filter attributes that strongly imply an LDAP filter (not a generic
+// key=value string). Shared across all language patterns.
+const ATTR = '(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf|userPrincipalName|distinguishedName|ou)';
+
+// Path A — concatenation/interpolation INSIDE (or adjacent to) the sink call.
+// High-confidence; does not need the file-level context hint.
 const FILTER_INLINE_RE = {
-  // Filter string concatenated INSIDE the .search call.
-  js:   /\bfilter\s*:\s*[`"']?\([^`"')]*\b(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=\s*[`"']?\s*(?:\+|\$\{)/g,
-  java: /\.search(?:_s)?\s*\(\s*[^,]+,\s*"[^"]*\b(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=[^"]*"\s*\+\s*\w+/g,
-  py:   /\.(?:search|search_s|search_ext|paged_search)\s*\([^)]*\b(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=[^)]*['"]?\s*\+\s*\w+/g,
+  js:   new RegExp(String.raw`\bfilter\s*:\s*[` + '`' + String.raw`"']?\([^` + '`' + String.raw`"')]*\b` + ATTR + String.raw`\s*=\s*[` + '`' + String.raw`"']?\s*(?:\+|\$\{)`, 'g'),
+  java: new RegExp(String.raw`\.search(?:_s)?\s*\(\s*[^,]+,\s*"[^"]*\b` + ATTR + String.raw`\s*=[^"]*"\s*\+\s*\w+`, 'g'),
+  py:   new RegExp(String.raw`\.(?:search|search_s|search_ext|paged_search)\s*\([^)]*\b` + ATTR + String.raw`\s*=[^)]*['"]?\s*\+\s*\w+`, 'g'),
+  php:  new RegExp(String.raw`\bldap_(?:search|list|read)\s*\([^)]*\(\s*` + ATTR + String.raw`\s*=[^)]*["']\s*\.\s*\$`, 'g'),
+  go:   new RegExp(String.raw`\b(?:NewSearchRequest|SearchRequest|Search)\s*\([^)]*"\(\s*` + ATTR + String.raw`\s*=[^"]*"\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
+  // C#: DirectorySearcher.Filter assigned a concat ("(uid=" + u) or an
+  // interpolated string ($"(uid={u})").
+  cs:   new RegExp(String.raw`\bFilter\s*=\s*\$?@?"[^"]*\(\s*` + ATTR + String.raw`\s*=[^"]*(?:"\s*\+|\{)`, 'g'),
+  // Ruby net-ldap: a filter built with #{} interpolation inside a search/
+  // construct/filter call.
+  rb:   new RegExp(String.raw`\.(?:search|filter|construct|equals)\s*\([^)]*\(\s*` + ATTR + String.raw`\s*=[^)]*#\{`, 'g'),
+  kt:   new RegExp(String.raw`\.search\s*\(\s*[^,]+,\s*"[^"]*\b` + ATTR + String.raw`\s*=[^"]*"\s*\+\s*\w+`, 'g'),
 };
 
-// Filter built in a variable then passed to .search. The signal is the
-// "(<attr>= + " pattern anywhere in the file.
-const FILTER_VAR_RE =
-  /["'`]\s*\(\s*(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=\s*["'`]?\s*\+\s*[A-Za-z_][\w.]*|f["']\s*\(\s*(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=\s*\{/g;
+// Path B — filter built in a variable then passed to the sink. Lower-
+// confidence, so gated on the file-level LDAP hint. Per-language because the
+// concat operator differs: `+` (js/java/py/go/cs/kt), `.` (php), `#{` (rb),
+// and interpolation forms (`${`, `f"…{`, `$"…{`).
+// `(?![\w.]*\s*\()` after the concat operand: a value immediately followed by `(`
+// is a function CALL (e.g. `ldap.EscapeFilter(u)`, `escape_filter_chars(u)`),
+// which is the *escaped* (safe) form — must not match.
+const FILTER_VAR_RE = {
+  js:   new RegExp(String.raw`["'` + '`' + String.raw`]\s*\(\s*` + ATTR + String.raw`\s*=\s*["'` + '`' + String.raw`]?\s*(?:\+|\$\{)\s*[A-Za-z_$][\w.]*(?![\w.]*\s*\()`, 'g'),
+  java: new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
+  py:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()|[fF]["']\s*\(\s*` + ATTR + String.raw`\s*=\s*\{`, 'g'),
+  php:  new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\.\s*\$[A-Za-z_]\w*`, 'g'),
+  go:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
+  cs:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()|\$"[^"]*\(\s*` + ATTR + String.raw`\s*=\s*\{`, 'g'),
+  rb:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=[^"']*#\{`, 'g'),
+  kt:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*(?:\+|\$\{)\s*[A-Za-z_$][\w.]*(?![\w.]*\s*\()`, 'g'),
+};
 
 // LDAP context hint: at least one of these must be in the file before we
 // trust the variable-form heuristic.
 const LDAP_HINT_RE =
-  /\b(?:DirContext|javax\.naming|ldap\.initialize|ldap3|ldapjs|LdapContext|InitialDirContext|SearchResult|conn\.search|client\.search|\.search_s|getLdapTemplate)\b/;
+  /\b(?:DirContext|javax\.naming|ldap\.initialize|ldap3|ldapjs|LdapContext|InitialDirContext|SearchResult|conn\.search|client\.search|\.search_s|getLdapTemplate|ldap_search|ldap_list|ldap_read|ldap_connect|ldap_bind|go-ldap|NewSearchRequest|DirectorySearcher|DirectoryEntry|System\.DirectoryServices|Net::LDAP|net\/ldap)\b/;
+
+// An LDAP filter-escape API applied in the file. When the value reaching a
+// filter is escaped, the metacharacter-injection risk is removed. We can't see
+// which variable on the sink line was escaped (escape-then-use spans lines —
+// e.g. PHP `$uid = ldap_escape(...); ... "(uid=" . $uid . ")"`), and the
+// inline call-guard only catches escape applied AT the concat. So when an
+// escape API is present in the file we suppress the lower-confidence finding —
+// matching the file-level guard-recognition style used elsewhere. Anchored on
+// real escape APIs so it doesn't over-suppress.
+const LDAP_ESCAPE_RE =
+  /\b(?:ldap_escape|EscapeFilter|escape_filter_chars|escapeForLDAP|encodeForLDAP|escapeLDAPSearchFilter|LDAP_ESCAPE_FILTER)\b|\bNet::LDAP::Filter\b|\bEqualityFilter\b|\bfilters\.\w+\b/;
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
 function _lang(fp) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) return 'js';
   if (/\.java$/i.test(fp)) return 'java';
   if (/\.py$/i.test(fp)) return 'py';
+  if (/\.(?:php|phtml)$/i.test(fp)) return 'php';
+  if (/\.go$/i.test(fp)) return 'go';
+  if (/\.cs$/i.test(fp)) return 'cs';
+  if (/\.rb$/i.test(fp)) return 'rb';
+  if (/\.kt$/i.test(fp)) return 'kt';
   return null;
 }
 
@@ -56,7 +105,10 @@ function _emit(fp, raw, line, why) {
       'Node ldapjs: `new EqualityFilter({ attribute: "uid", value: name })`. ' +
       'Java JNDI: bind via search filter args — `ctx.search(base, "(uid={0})", new Object[]{ name }, controls)`. ' +
       'Python python-ldap: `ldap.filter.escape_filter_chars(name)`. ' +
-      'Python ldap3: pass the value through a Connection bind-format helper.',
+      'PHP: `ldap_escape($name, "", LDAP_ESCAPE_FILTER)`. ' +
+      'Go go-ldap: `ldap.EscapeFilter(name)`. ' +
+      'C#: set `DirectorySearcher` with an escaped value or use parameterized binding. ' +
+      'Ruby net-ldap: `Net::LDAP::Filter.eq("uid", name)` instead of interpolating.',
     parser: 'LDAP-INJECTION',
     confidence: 0.85,
   };
@@ -66,12 +118,16 @@ export function scanLDAPInjection(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const lang = _lang(fp);
   if (!lang) return [];
-  const code = blankComments(raw, lang === 'py' ? 'py' : undefined);
+  const code = blankComments(raw, (lang === 'py' || lang === 'rb') ? 'py' : undefined);
   const findings = [];
   const seen = new Set();
+  // Escape-then-use: if the file applies an LDAP escape API, the filter value
+  // is sanitized before substitution — suppress (recall-safe per the corpus
+  // post/ pairs, which are the invariant proving this doesn't drop a real TP).
+  const escaped = LDAP_ESCAPE_RE.test(code);
   // Path A — concatenation inside the .search call. High-confidence,
-  // doesn't need the context hint.
-  {
+  // doesn't need the context hint (but still skip when the file escapes).
+  if (!escaped) {
     const re = new RegExp(FILTER_INLINE_RE[lang].source, FILTER_INLINE_RE[lang].flags);
     let m;
     while ((m = re.exec(code))) {
@@ -85,8 +141,8 @@ export function scanLDAPInjection(fp, raw) {
   // Path B — filter built into a variable then passed downstream. Lower-
   // confidence so we gate on a file-level LDAP hint to suppress unrelated
   // string concatenations.
-  if (LDAP_HINT_RE.test(code)) {
-    const re = new RegExp(FILTER_VAR_RE.source, FILTER_VAR_RE.flags);
+  if (!escaped && LDAP_HINT_RE.test(code)) {
+    const re = new RegExp(FILTER_VAR_RE[lang].source, FILTER_VAR_RE[lang].flags);
     let m;
     while ((m = re.exec(code))) {
       const line = lineOf(raw, m.index);