@clear-capabilities/agentic-security-scanner 0.86.0 → 0.118.2

package/src/sast/open-redirect.js

@@ -33,11 +33,20 @@ const PATTERNS = [
   ['java', /\bnew\s+RedirectView\s*\(\s*(\w[\w.]*)\s*\)/g, 'Spring RedirectView'],
   // PHP header("Location: " . $...)
   ['php', /\bheader\s*\(\s*['"]\s*Location\s*:\s*['"]\s*\.\s*(\$\w[\w\[\]'"]*)/g, 'PHP Location'],
+  // Go net/http: http.Redirect(w, r, <target>, code) — target is the 3rd arg
+  // (may contain calls/parens); status is a digit or an http.Status* constant.
+  ['go', /\bhttp\.Redirect\s*\(\s*[^,]+,\s*[^,]+,\s*([\s\S]+?)\s*,\s*(?:\d|http\.Status)/g, 'Go net/http'],
+  // Ruby on Rails: redirect_to <target> (params/var).
+  ['rb', /\bredirect_to\s+(?!.*\bonly_path:\s*true)([^\n,]+?)(?:\s+status:|\s*$|\n)/gm, 'Rails redirect_to'],
+  // C#: Response.Redirect(<target>) / return Redirect(<target>) / RedirectPermanent.
+  ['cs', /\b(?:Response\.Redirect|return\s+Redirect|return\s+RedirectPermanent|RedirectPermanent)\s*\(\s*([^)]+?)\s*\)/g, 'ASP.NET Redirect'],
+  // Kotlin/Servlet: resp.sendRedirect(<target>).
+  ['kt', /\.\s*sendRedirect\s*\(\s*([^)]+?)\s*\)/g, 'Servlet sendRedirect'],
 ];
 
 // What counts as "user-derived" inside the captured target expression.
 const TAINT_HINT_RE =
-  /\b(?:req\.|request\.|params\.|query\.|body\.|ctx\.query|ctx\.request|ctx\.params|reply\.query|r\.URL\.Query|c\.Query|next\b|_GET|_POST|_REQUEST|getParameter|getHeader)\b/;
+  /\b(?:req\.|request\.|params\.|params\s*\[|query\.|body\.|ctx\.query|ctx\.request|ctx\.params|reply\.query|r\.URL\.Query|c\.Query|c\.Param|next\b|_GET|_POST|_REQUEST|getParameter|getHeader|Request\.(?:Query|Form|Params|QueryString))\b|\b(?:params|query|cookies)\s*\[/;
 
 // What counts as an allow-list check earlier in the function. We look back
 // up to 30 lines before the redirect call for any of these patterns.
@@ -54,6 +63,12 @@ const ALLOWLIST_PATTERNS = [
   /allowedRedirectTargets/i,
   /\babort\s*\(\s*4\d\d/,                        // any abort(4xx) earlier
   /\bres\s*\.\s*status\s*\(\s*4\d\d\b/,
+  /\bin_array\s*\(/i,                            // PHP in_array(...) allow-list check
+  /\bonly_path:\s*true/,                         // Rails redirect_to …, only_path: true
+  /\bUrl\.IsLocalUrl\b|\bLocalRedirect\b/,       // ASP.NET local-only redirect
+  /\bin\s+(?:allowed|allow|ALLOWED)\b/,          // Kotlin/Ruby `next in allowed`
+  /\bstrings\.HasPrefix\s*\(\s*\w+\s*,\s*"\/"/,  // Go relative-path check
+  /\bset(?:Of)?\s*\([^)]*\)\.contains\b/,        // Kotlin allowed.contains(next)
 ];
 
 function _lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -61,10 +76,34 @@ function _lang(fp) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) return 'js';
   if (/\.py$/i.test(fp)) return 'py';
   if (/\.java$/i.test(fp)) return 'java';
-  if (/\.php$/i.test(fp)) return 'php';
+  if (/\.(?:php|phtml)$/i.test(fp)) return 'php';
+  if (/\.go$/i.test(fp)) return 'go';
+  if (/\.rb$/i.test(fp)) return 'rb';
+  if (/\.cs$/i.test(fp)) return 'cs';
+  if (/\.kt$/i.test(fp)) return 'kt';
   return null;
 }
 
+// For C#/Kotlin/Go a bare-identifier redirect target is user-derived when it is
+// a parameter of the enclosing method/handler (the single-file handler shape).
+const _PARAM_LANGS = new Set(['cs', 'kt', 'go']);
+function _isEnclosingParam(code, callIdx, target) {
+  if (!/^[A-Za-z_]\w*$/.test(target)) return false;
+  const before = code.slice(0, callIdx);
+  const sigRe = /\b(?:fun\s+\w+|func\s+\w*|[A-Za-z_][\w<>\[\],.\s]*\b\w+)\s*\(([^)]*)\)\s*(?::[^={]+|[A-Za-z_][\w.<>\[\]* ]*)?\{/g;
+  let sig = null, sm;
+  while ((sm = sigRe.exec(before)) !== null) sig = sm;
+  if (!sig) return false;
+  const params = sig[1].split(',').map((p) => {
+    const t = p.trim(); if (!t) return '';
+    if (t.includes(':')) return t.split(':')[0].trim();      // Kotlin name: Type
+    return (t.split(/\s+/)[t.includes(' ') ? (t.trim().split(/\s+/).length - 1) : 0] || '').trim();
+  });
+  // Go params are `name Type` (name first); JVM/C# are `Type name` (name last).
+  const goParams = sig[1].split(',').map((p) => (p.trim().split(/\s+/)[0] || '').trim());
+  return params.includes(target) || goParams.includes(target);
+}
+
 function _allowListedPrior(raw, callLine, target) {
   const lines = raw.split('\n');
   const lo = Math.max(0, callLine - 30);
@@ -79,8 +118,8 @@ export function scanOpenRedirect(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const lang = _lang(fp);
   if (!lang) return [];
-  const code = blankComments(raw, lang === 'py' ? 'py' : undefined);
-  if (!/\bredirect\b|RedirectView|HttpResponseRedirect|Location\s*:/i.test(code)) return [];
+  const code = blankComments(raw, (lang === 'py' || lang === 'rb') ? 'py' : undefined);
+  if (!/\bredirect|RedirectView|HttpResponseRedirect|Location\s*:|sendRedirect|http\.Redirect/i.test(code)) return [];
   const findings = [];
   const seen = new Set();
   for (const [plang, pat, framework] of PATTERNS) {
@@ -90,7 +129,10 @@ export function scanOpenRedirect(fp, raw) {
     while ((m = re.exec(code))) {
       const target = (m[1] || '').trim();
       if (!target) continue;
-      if (!TAINT_HINT_RE.test(target)) continue;
+      // Literal-string target ("/home", "https://fixed") is never user-derived.
+      if (/^["'`][^"'`]*["'`]$/.test(target)) continue;
+      if (!TAINT_HINT_RE.test(target) &&
+          !(_PARAM_LANGS.has(plang) && _isEnclosingParam(code, m.index, target))) continue;
       const line = _lineOf(raw, m.index);
       // Suppress if an allow-list check appears in the preceding window.
       if (_allowListedPrior(raw, line, target)) continue;

package/src/sast/php.js

@@ -18,6 +18,21 @@ const RE = {
   extractRequest: /\bextract\s*\(\s*\$(?:_REQUEST|_GET|_POST|HTTP_GET_VARS|HTTP_POST_VARS)\s*[,)]/g,
   passwordHashMd5: /\b(?:md5|sha1)\s*\(\s*\$(?:_(?:REQUEST|GET|POST)|password|passwd|pwd|hash_input)/gi,
   phpinfo: /\bphpinfo\s*\(/g,
+  // Structural (taint-independent): a shell or SQL sink built with string
+  // concat (`'…' .`) or double-quote `$var` interpolation is the injection
+  // shape regardless of the source token — the rules above require the literal
+  // $_REQUEST/$_GET/$_POST on the sink line, which misses framework idioms
+  // (`$f = $r->query->get('x'); shell_exec('gzip ' . $f)`).
+  cmdInjectionStructural: /\b(?:shell_exec|exec|system|passthru|popen|proc_open|pcntl_exec)\s*\(\s*(?:"[^"\n]*\$|'[^'\n]*'\s*\.|"[^"\n]*"\s*\.)/g,
+  sqlInjectionStructural: /\b(?:DB::raw|DB::select|DB::statement|DB::insert|DB::update|DB::delete|whereRaw|orWhereRaw|havingRaw|selectRaw|orderByRaw|mysqli_query|mysql_query|pg_query|pg_send_query|sqlite_query|->query|->rawQuery)\s*\(\s*(?:DB::raw\s*\(\s*)?(?:"[^"\n]*\$|"[^"\n]*"\s*\.|'[^'\n]*'\s*\.)/g,
+  // Structural path traversal: a filesystem read/write built by concatenating
+  // or interpolating into the path. Containment-guarded forms (basename) are
+  // dropped centrally by engine.js dropGuardedFindings (CWE-22).
+  pathTraversalStructural: /\b(?:readfile|file_get_contents|file_put_contents|fopen|fpassthru|fgets|file|copy|unlink|highlight_file|show_source)\s*\(\s*(?:"[^"\n]*"\s*\.|'[^'\n]*'\s*\.|"[^"\n]*\$(?:_(?:REQUEST|GET|POST|COOKIE)|[A-Za-z_]))/g,
+  // SSRF: a network fetch whose URL is user-controlled. cURL is unambiguously
+  // network; file_get_contents/fopen with a $_GET/$_POST value direct (not a
+  // path-base concat) is the PHP fopen-wrapper SSRF (http:// / ftp:// / phar://).
+  ssrfFetch: /\bcurl_init\s*\(\s*\$(?:_(?:REQUEST|GET|POST|COOKIE)|\w*url\w*)|\bcurl_setopt\s*\([^,]+,\s*CURLOPT_URL\s*,\s*\$(?:_(?:REQUEST|GET|POST|COOKIE)|\w*url\w*)|\b(?:file_get_contents|fopen)\s*\(\s*\$_(?:REQUEST|GET|POST|COOKIE)\b/g,
 };
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -75,6 +90,26 @@ export function scanPhp(fp, raw) {
           severity: 'high', cwe: 'CWE-200',
           remediation: 'Delete phpinfo() before deploy. It leaks the PHP version, loaded extensions, environment variables, document root, and request headers — a one-shot recon page for an attacker.',
         },
+        cmdInjectionStructural: {
+          vuln: 'Command Injection: shell function built with string concat / interpolation',
+          severity: 'critical', cwe: 'CWE-78',
+          remediation: 'Use the array form of proc_open(["gzip", $f], ...) so no shell parses the string, and validate inputs. Never concatenate or interpolate values into shell_exec/exec/system/passthru.',
+        },
+        sqlInjectionStructural: {
+          vuln: 'SQL Injection: raw query built with string concat / interpolation',
+          severity: 'critical', cwe: 'CWE-89',
+          remediation: 'Use parameter bindings: DB::select("SELECT … WHERE name = ?", [$name]) or the query builder with bindings. Never concatenate/interpolate into DB::raw / whereRaw / mysqli_query.',
+        },
+        pathTraversalStructural: {
+          vuln: 'Path Traversal: filesystem operation built with concatenated/interpolated input',
+          severity: 'high', cwe: 'CWE-22', family: 'path-traversal',
+          remediation: 'Strip directory components with basename() and resolve against a fixed root: $full = realpath($base . "/" . basename($name)); if (strpos($full, $base) !== 0) abort(). Never concatenate request input straight into a file path.',
+        },
+        ssrfFetch: {
+          vuln: 'SSRF: network fetch (cURL / fopen-wrapper) to a user-controlled URL',
+          severity: 'high', cwe: 'CWE-918', family: 'ssrf',
+          remediation: 'Validate the URL host against an allow-list and reject RFC1918 / link-local / metadata (169.254.169.254) addresses before fetching. Disable fopen URL wrappers (allow_url_fopen=0) and only allow https:// to known hosts.',
+        },
       }[key];
       push({
         id: `php-${key}:${fp}:${line}`,

package/src/sast/python-structural.js

@@ -0,0 +1,83 @@
+// Python framework structural detectors — PRD Tier 1 (JS/Python recall).
+//
+// Closes Flask/Django handler FNs where user input is concatenated into a
+// template or raw SQL. Taint-independent: the concat / f-string / %-format is
+// the injection shape. Crucially, a Jinja `{{ name }}` placeholder is SAFE
+// (auto-escaped), so `{` alone is NOT a signal — only `+`, f-strings, or
+// `.format()`/`%`.
+
+import { blankComments } from './_comment-strip.js';
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+// A string literal that may contain the *other* quote char (a SQL string like
+// `"… name = '"` embeds a single quote) — the naive `["'][^"'\n]*["']` breaks
+// on the embedded quote and misses the concat. Match each quote style with its
+// own body so embedded quotes are allowed.
+const STR = String.raw`(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')`;
+// Dynamic-string shape inside a sink call: concat (`"…" +`), f-string (`f"…"`),
+// `.format(`, or `%`-format via the `%` OPERATOR after the string (`"…%s" % v`).
+// NOT a plain literal, and NOT a `%s` placeholder followed by a params list —
+// `execute("… %s", [v])` is the SAFE parameterized DB-API form.
+const DYN = String.raw`(?:[fF]["']|${STR}\s*\+|${STR}\s*%\s*[(\w]|${STR}\s*\.\s*format\s*\()`;
+
+export function scanPythonStructural(fp, raw) {
+  if (!/\.py$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw, 'py');
+  const findings = [];
+  const seen = new Set();
+  const emit = (key, line, meta) => {
+    const id = `py-struct-${key}:${fp}:${line}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line, vuln: meta.vuln, severity: meta.severity, cwe: meta.cwe,
+      family: meta.family, parser: 'PYTHON', confidence: meta.confidence ?? 0.7,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200), remediation: meta.remediation,
+    });
+  };
+
+  // Flask SSTI: render_template_string built from a dynamic string. A static
+  // template with Jinja `{{ }}` placeholders is safe and must not match.
+  const SSTI_RE = new RegExp(String.raw`\brender_template_string\s*\(\s*` + DYN, 'g');
+  let m;
+  while ((m = SSTI_RE.exec(code))) emit('flask-ssti', lineOf(code, m.index), {
+    // render_template_string with a built string is both reflected XSS
+    // (unescaped user input in the rendered HTML) and template injection
+    // (`{{7*7}}` executes). Classified CWE-79 (the dominant, ground-truth
+    // taxonomy); the remediation covers the SSTI aspect too.
+    vuln: 'Reflected XSS / template injection (SSTI) via render_template_string (Flask)',
+    severity: 'critical', cwe: 'CWE-79', family: 'xss', confidence: 0.7,
+    remediation: 'Use a static template with `{{ }}` placeholders and pass values as named context (`render_template_string("Hi {{ name }}", name=name)`). Never build the template body from input.',
+  });
+
+  // Django raw SQL: .raw() / .extra() built from a dynamic string.
+  const DJ_RE = new RegExp(String.raw`\.\s*(?:raw|extra)\s*\(\s*` + DYN, 'g');
+  while ((m = DJ_RE.exec(code))) emit('django-sqli', lineOf(code, m.index), {
+    vuln: 'SQL Injection — Django raw()/extra() built with string concat / format (Python)',
+    severity: 'critical', cwe: 'CWE-89', family: 'sql-injection', confidence: 0.7,
+    remediation: 'Use the ORM with an allow-list for column/order fields, or parameterize: `User.objects.raw("… WHERE name = %s", [name])`. Never concatenate into raw SQL.',
+  });
+
+  // DB-API cursor.execute built from a dynamic string.
+  const EXEC_RE = new RegExp(String.raw`\.\s*execute(?:script)?\s*\(\s*` + DYN, 'g');
+  while ((m = EXEC_RE.exec(code))) emit('cursor-sqli', lineOf(code, m.index), {
+    vuln: 'SQL Injection — cursor.execute built with string concat / format (Python)',
+    severity: 'critical', cwe: 'CWE-89', family: 'sql-injection', confidence: 0.7,
+    remediation: 'Pass parameters as the second argument with `%s` placeholders: `cursor.execute("… WHERE id = %s", [id])`. Never concatenate or %-format values into the SQL string.',
+  });
+
+  // Path traversal: a file-open / send_file built from a dynamic string
+  // (concat / f-string / format). `open('/var/data/' + name)` is the shape;
+  // a bare literal path is not. Hardened forms (os.path.basename, secure
+  // containment) are removed by engine.js dropGuardedFindings (CWE-22).
+  const PATH_RE = new RegExp(String.raw`\b(?:open|os\.open|io\.open|codecs\.open|send_file|send_from_directory)\s*\(\s*` + DYN, 'g');
+  while ((m = PATH_RE.exec(code))) emit('path-traversal', lineOf(code, m.index), {
+    vuln: 'Path Traversal — file path built with string concat / f-string / format (Python)',
+    severity: 'high', cwe: 'CWE-22', family: 'path-traversal', confidence: 0.62,
+    remediation: 'Strip directory components and assert containment: `safe = os.path.basename(name); full = os.path.join(BASE, safe); assert os.path.realpath(full).startswith(BASE)`. Never concatenate user input straight into a file path.',
+  });
+
+  return findings;
+}

package/src/sast/redos-nfa.js

@@ -305,6 +305,73 @@ export function extractJavaRegexBodies(code) {
   return out;
 }
 
+// Go: regexp.MustCompile / Compile / MatchString("…") — Go string literals use
+// "…" (interpreted) or `…` (raw). Both carry the pattern verbatim.
+export function extractGoRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/\bregexp\.(?:MustCompile|Compile|CompilePOSIX|MatchString|Match)\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\bregexp\.(?:MustCompile|Compile|CompilePOSIX|MatchString|Match)\s*\(\s*`([^`]+)`/g)) {
+    out.push({ body: m[1], line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+// PHP: preg_match / preg_match_all / preg_replace("/…/flags", …) — the regex is
+// a delimited string; strip the delimiter + trailing flags.
+export function extractPhpRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/\bpreg_(?:match|match_all|replace|replace_callback|split)\s*\(\s*(['"])(.+?)\1/g)) {
+    let lit = m[2];
+    // delimited: first char is the delimiter (e.g. / # ~), trailing flags after it
+    const delim = lit[0];
+    const close = lit.lastIndexOf(delim);
+    if (close > 0) lit = lit.slice(1, close);
+    out.push({ body: lit, line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+// Ruby: a regex literal /…/ used with =~ / .match / .match? / Regexp.new("…").
+export function extractRubyRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/(?:=~|\.match\??|\.scan|\.gsub|\.sub|grep)\s*\(?\s*\/((?:\\.|[^\/\n])+)\//g)) {
+    out.push({ body: m[1], line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\bRegexp\.new\s*\(\s*['"]((?:\\.|[^'"\n])+)['"]/g)) {
+    out.push({ body: m[1], line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+// C#: new Regex("…") / Regex.IsMatch(s, "…") / Regex.Match / Regex.Replace.
+export function extractCsharpRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/\bnew\s+Regex\s*\(\s*@?"((?:\\.|""|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/""/g, '"'), line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\bRegex\.(?:IsMatch|Match|Matches|Replace|Split)\s*\(\s*[^,]+,\s*@?"((?:\\.|""|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/""/g, '"'), line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+// Kotlin: Regex("…") / "…".toRegex() / Pattern.compile("…").
+export function extractKotlinRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/\bRegex\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/"((?:\\.|[^"\n])+)"\s*\.\s*toRegex\s*\(/g)) {
+    out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\bPattern\.compile\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
 export function scanRegexReDoS(file, raw) {
   if (!file || !raw || typeof raw !== 'string') return [];
   if (raw.length > 500_000) return [];
@@ -313,6 +380,14 @@ export function scanRegexReDoS(file, raw) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(file)) bodies = extractJsRegexBodies(raw);
   else if (/\.py$/i.test(file)) bodies = extractPyRegexBodies(raw);
   else if (/\.java$/i.test(file)) bodies = extractJavaRegexBodies(raw);
+  // NOTE: Go's regexp package uses RE2 (guaranteed linear time, no catastrophic
+  // backtracking), so Go is intentionally NOT scanned for ReDoS — a "vulnerable"
+  // pattern there is not actually exploitable. (extractGoRegexBodies is exported
+  // for completeness / third-party regexp libs but not wired into the default.)
+  else if (/\.(?:php|phtml)$/i.test(file)) bodies = extractPhpRegexBodies(raw);
+  else if (/\.rb$/i.test(file)) bodies = extractRubyRegexBodies(raw);
+  else if (/\.cs$/i.test(file)) bodies = extractCsharpRegexBodies(raw);
+  else if (/\.kt$/i.test(file)) bodies = extractKotlinRegexBodies(raw);
   else return [];
 
   for (const { body, line } of bodies) {

package/src/sast/response-splitting.js

@@ -24,25 +24,43 @@
 
 import { blankComments } from './_comment-strip.js';
 
+// Each pattern captures the header VALUE expression in its LAST group (the
+// code reads the last defined group, so header-name groups can come first).
 const PATTERNS = [
   // res.setHeader('name', val) | res.set('name', val) | ctx.response.set(…)
   ['js', /\b(?:res|reply|response|ctx\.response)\s*\.\s*(?:setHeader|set|append)\s*\(\s*[`"'][^`"']+[`"']\s*,\s*([^)]+?)\s*\)/g, 'res.setHeader'],
   // response.setHeader / response.addHeader  (Java Servlet API). Accept any
   // identifier as the receiver — `resp`, `response`, `httpResponse`, etc.
-  ['java', /\b(?:[A-Za-z_][\w]*)\s*\.\s*(?:setHeader|addHeader)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'setHeader'],
+  ['java', /\b(?:[A-Za-z_][\w]*)\s*\.\s*(?:setHeader|addHeader|addIntHeader|setDateHeader)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'setHeader'],
   // Django/Flask response.headers['X-…'] = userValue
   ['py', /\b(?:response|resp|r)\s*(?:\.\s*headers)?\s*\[\s*['"][^'"]+['"]\s*\]\s*=\s*([^\n;]+)/g, 'response.headers[…] = …'],
   // PHP header("X-Foo: " . $_GET[…])  (Location: variants handled by open-redirect)
   ['php', /\bheader\s*\(\s*['"](?!Location)([^'"]+):\s*['"]\s*\.\s*(\$\w[\w\[\]'"]*)/g, 'PHP header()'],
+  // Go net/http: w.Header().Set/Add("X-…", value) | w.Header()["X-…"] = …
+  ['go', /\.\s*Header\s*\(\s*\)\s*\.\s*(?:Set|Add)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'Header().Set'],
+  // Ruby Rack/Rails: response.headers["X-…"] = … | headers["X-…"] = … | response["X-…"] = …
+  ['rb', /\b(?:response\s*(?:\.\s*headers)?|headers)\s*\[\s*['"][^'"]+['"]\s*\]\s*=\s*([^\n;]+)/g, 'response headers[…] = …'],
+  // C#: Response.Headers.Add/Append("X-…", value) | Response.AddHeader(…) | Response.AppendHeader(…)
+  ['cs', /\bResponse\s*\.\s*(?:Headers\s*\.\s*(?:Add|Append)|AddHeader|AppendHeader)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'Response.Headers.Add'],
+  // Kotlin: resp.setHeader("X-…", value) | resp.addHeader(…) — JVM servlet API
+  ['kt', /\b(?:[A-Za-z_][\w]*)\s*\.\s*(?:setHeader|addHeader)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'setHeader'],
 ];
 
 const TAINT_HINT_RE =
-  /\b(?:req\.|request\.|params\.|query\.|body\.|ctx\.query|ctx\.request|reply\.query|c\.Query|r\.URL\.Query|_GET|_POST|_REQUEST|getParameter|getHeader)\b/;
+  /\b(?:req\.|request\.|params\.|params\s*\[|query\.|body\.|ctx\.query|ctx\.request|reply\.query|c\.Query|r\.URL\.Query|_GET|_POST|_REQUEST|getParameter|getHeader)\b|\b(?:params|query|cookies|session)\s*\[/;
 
 const SANITIZER_PATTERNS = [
   /\.replace\s*\(\s*\/\\r\?\\?n/i,                // .replace(/\r?\n/, '')
   /\.replace\s*\(\s*\/[\[]\\r\\n[\]]/i,           // .replace(/[\r\n]/, '')
+  /\.replace\s*\(\s*['"]\\r['"]/,                 // .replace("\r", "") (Python/JS chain)
+  /\.replace\s*\(\s*['"]\\n['"]/,                 // .replace("\n", "")
   /\.replaceAll\s*\(\s*['"]\\r?\\?n?['"]/,
+  /\bgsub\s*\(\s*\/[\[]?\\r/i,                    // Ruby .gsub(/[\r\n]/, '') or /\r\n/
+  /\bgsub\s*\(\s*\/[\[]\\r\\n[\]]/i,
+  /\bdelete\s*\(\s*['"]\\r\\n['"]\s*\)/,          // Ruby .delete("\r\n")
+  /\bstrings\.NewReplacer\s*\([^)]*\\r/,          // Go strings.NewReplacer("\r","","\n","")
+  /\bstrings\.ReplaceAll\s*\([^,]+,\s*['"]\\[rn]['"]/,
+  /\bstr_replace\s*\(\s*\[[^\]]*\\[rn]/,          // PHP str_replace(["\r","\n"], …)
   /\bstripNewlines\b/i,
   /\bsanitizeHeader\b/i,
   /\bescapeCRLF\b/i,
@@ -63,7 +81,11 @@ function _lang(fp) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) return 'js';
   if (/\.py$/i.test(fp)) return 'py';
   if (/\.java$/i.test(fp)) return 'java';
-  if (/\.php$/i.test(fp)) return 'php';
+  if (/\.(?:php|phtml)$/i.test(fp)) return 'php';
+  if (/\.go$/i.test(fp)) return 'go';
+  if (/\.rb$/i.test(fp)) return 'rb';
+  if (/\.cs$/i.test(fp)) return 'cs';
+  if (/\.kt$/i.test(fp)) return 'kt';
   return null;
 }
 
@@ -79,8 +101,8 @@ export function scanResponseSplitting(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const lang = _lang(fp);
   if (!lang) return [];
-  const code = blankComments(raw, lang === 'py' ? 'py' : undefined);
-  if (!/\b(?:setHeader|addHeader|response\s*\.\s*headers|response\s*\[|reply\s*\.\s*set|\bheader\s*\()/i.test(code)) return [];
+  const code = blankComments(raw, (lang === 'py' || lang === 'rb') ? 'py' : undefined);
+  if (!/\b(?:setHeader|addHeader|addIntHeader|setDateHeader|AddHeader|AppendHeader|response\s*\.\s*headers|response\s*\[|headers\s*\[|reply\s*\.\s*set|\.\s*Header\s*\(\s*\)\s*\.\s*(?:Set|Add)|Response\s*\.\s*Headers|\bheader\s*\()/i.test(code)) return [];
   const findings = [];
   const seen = new Set();
   for (const [plang, pat, label] of PATTERNS) {
@@ -88,23 +110,30 @@ export function scanResponseSplitting(fp, raw) {
     const re = new RegExp(pat.source, pat.flags);
     let m;
     while ((m = re.exec(code))) {
-      const value = (m[1] || '').trim();
+      // Use the LAST defined capture group as the header VALUE (php's pattern
+      // captures the header NAME first, the value second).
+      const value = ((m[m.length - 1] ?? m[1]) || '').trim();
       let tainted = TAINT_HINT_RE.test(value);
-      // Java-handler-context heuristic: if the receiver looks like an
-      // HttpServletResponse and `value` is a plain ident that appears in
-      // the enclosing method's param list, treat it as user-derived. Same
-      // signature pattern as a real SAST tool's "request-scope param" rule.
-      if (!tainted && plang === 'java' && /^[A-Za-z_][\w]*$/.test(value)) {
-        const callIdx = m.index;
-        // Find the start of the enclosing method by walking back to the
-        // most recent `(...)`-style signature followed by `{`.
-        const before = code.slice(0, callIdx);
-        const sigRe = /\b(?:public|private|protected|static)[^;{]*\(([^)]*)\)\s*(?:throws[^{]+)?\{/g;
-        let sig = null;
-        let sm;
+      // Handler-context heuristic: when `value` is a plain identifier that is a
+      // parameter of the enclosing method/function, treat it as user-derived
+      // (same "request-scope param" rule a real SAST tool applies). Covers the
+      // single-file `void h(String v, … resp){ resp.setHeader("X", v); }` shape
+      // for Java / Kotlin / C#.
+      if (!tainted && (plang === 'java' || plang === 'kt' || plang === 'cs') && /^[A-Za-z_][\w]*$/.test(value)) {
+        const before = code.slice(0, m.index);
+        // Most recent signature `(...)` immediately followed by `{` — matches
+        // Java/C# (`… name(params) {`) and Kotlin (`fun name(params) … {`).
+        const sigRe = /\b(?:fun\s+\w+|[A-Za-z_][\w<>\[\],.\s]*\b\w+)\s*\(([^)]*)\)\s*(?::[^={]+)?(?:throws[^{]+)?\{/g;
+        let sig = null, sm;
         while ((sm = sigRe.exec(before)) !== null) sig = sm;
         if (sig) {
-          const params = sig[1].split(',').map(p => (p.trim().split(/\s+/).pop() || '').trim());
+          // Param name is the last token of each `Type name` / first of Kotlin `name: Type`.
+          const params = sig[1].split(',').map((p) => {
+            const t = p.trim();
+            if (!t) return '';
+            if (t.includes(':')) return t.split(':')[0].trim();      // Kotlin `name: Type`
+            return (t.split(/\s+/).pop() || '').trim();              // Java/C# `Type name`
+          });
           if (params.includes(value)) tainted = true;
         }
       }

package/src/sast/ruby.js

@@ -23,6 +23,24 @@ const RE = {
   attributesEq: /\.\s*attributes\s*=\s*params\b(?!\s*\.permit)/g,
   openSsrf: /\b(?:open|URI\.open|URI\.parse\([^)]*\)\.read)\s*\(\s*(?:params|request|@\w+\.params)\b/g,
   fileRead: /\bFile\s*\.\s*(?:read|open|new|readlines)\s*\(\s*params\s*\[/g,
+  // Structural (taint-independent): an ActiveRecord query or shell command
+  // built with string interpolation (#{...}) or concat is the injection shape
+  // regardless of whether the value is `params` or a local variable that came
+  // from params — the existing rules above require the literal `params` token
+  // on the sink line, which misses `name = params[:x]; where("... #{name}")`.
+  sqlInjectionStructural: /\.(?:where|find_by_sql|having|order|group|joins|select|from|pluck|update_all|delete_all|exec_query|execute|select_all|select_value|find_by)\s*\(\s*(?:"[^"\n]*#\{|['"][^'"\n]*['"]\s*\+)/g,
+  cmdInjectionStructural: /(?:`[^`\n]*#\{|\b(?:system|exec)\s*\(\s*"[^"\n]*#\{|\bIO\.popen\s*\(\s*"[^"\n]*#\{|\b(?:system|exec)\s*\(\s*['"][^'"\n]*['"]\s*\+)/g,
+  // Structural path traversal: File/IO op whose path is built by interpolation
+  // (#{...}) or concat. `File.read("/data/" + name)` routes through a local var
+  // so the `params[`-on-sink fileRead rule misses it. Containment-guarded forms
+  // (File.expand_path + start_with?) are dropped by engine.js dropGuardedFindings.
+  pathTraversalStructural: /\b(?:File|IO)\s*\.\s*(?:read|open|new|readlines|binread|write|foreach)\s*\(\s*(?:"[^"\n]*#\{|['"][^'"\n]*['"]\s*\+)/g,
+  // Structural deserialization (taint-independent): Marshal.load / YAML.load /
+  // YAML.unsafe_load are unsafe on ANY non-trivial argument — the danger is the
+  // sink, not the source. The `params`-on-sink marshalLoad/yamlUnsafe rules
+  // above miss `data = request.body.read; Marshal.load(data)`. A bare string
+  // literal arg (Marshal.load("...")) won't match (`\w` requires an identifier).
+  deserStructural: /\bMarshal\s*\.\s*load\s*\(\s*[A-Za-z_@]\w*|\bYAML\s*\.\s*(?:load|unsafe_load)\s*\(\s*[A-Za-z_@]\w*/g,
 };
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -92,6 +110,26 @@ export function scanRuby(fp, raw) {
           severity: 'high', cwe: 'CWE-22',
           remediation: 'Canonicalize the path and verify it stays under an allowed base: `path = File.expand_path(File.join(base, name)); raise unless path.start_with?(base)`.',
         },
+        sqlInjectionStructural: {
+          vuln: 'SQL Injection: ActiveRecord query built with string interpolation / concat',
+          severity: 'critical', cwe: 'CWE-89',
+          remediation: 'Use the parameterized form: `User.where("name = ?", name)` or `where(name: name)`. Never interpolate (`#{...}`) or concatenate values into a SQL fragment.',
+        },
+        cmdInjectionStructural: {
+          vuln: 'Command Injection: shell command built with string interpolation / concat',
+          severity: 'critical', cwe: 'CWE-78',
+          remediation: 'Use `Open3.capture2("cmd", arg1, arg2)` with separate arguments (no shell). Backticks and `system("... #{x}")` run through the shell.',
+        },
+        pathTraversalStructural: {
+          vuln: 'Path Traversal: File/IO operation built with interpolated/concatenated path',
+          severity: 'high', cwe: 'CWE-22',
+          remediation: 'Canonicalize and assert containment: `path = File.expand_path(File.join(base, name)); raise unless path.start_with?(base)`. Never interpolate/concatenate request input straight into a file path.',
+        },
+        deserStructural: {
+          vuln: 'Insecure Deserialization: Marshal.load / YAML.load on a non-literal value',
+          severity: 'critical', cwe: 'CWE-502', family: 'insecure-deserialization',
+          remediation: 'Marshal and YAML.load instantiate arbitrary Ruby objects (RCE gadget chains). Use JSON for data crossing a trust boundary, or YAML.safe_load(input, permitted_classes: [Symbol]). Never Marshal.load attacker-controlled bytes.',
+        },
       }[key];
       push({
         id: `ruby-${key}:${fp}:${line}`,

package/src/sast/secret-concat.js

@@ -0,0 +1,60 @@
+// Split-concatenation secret detector (language-agnostic) — PRD Tier 1.
+//
+// A hardcoded credential is frequently SPLIT across concatenated string
+// literals specifically to slip past secret regexes that anchor on a
+// contiguous token:  `AWS_KEY = 'AKIA' + 'IOSFODNN7EXAMPLE'`,
+// `GITHUB_TOKEN = 'ghp' + '_…'`, `STRIPE_KEY = 'sk' + '_live_…' + '…'`.
+//
+// We join the literals back together and match the *reassembled* value against
+// known provider prefixes (high precision — these markers don't occur by
+// accident) or, for a credential-named LHS, a long joined literal. The flow
+// engine and the contiguous-token secrets scanner both miss the split shape;
+// csharp-structural.js handles it for C# only. This covers JS/TS/Py/Rb/Go/
+// Java/PHP via the `+` (and PHP `.`) concat operators.
+
+import { blankComments } from './_comment-strip.js';
+
+// Real provider markers — anchored, so a generic `'foo' + 'bar'` won't match.
+const SECRET_PREFIX = /(?:sk_|sk-|AKIA|ASIA|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|xox[abprs]-|AIza|ya29\.|eyJ[A-Za-z0-9_-]{8,}|-----BEGIN|glpat-|shpat_|shpss_|npm_|dop_v1_|SG\.[A-Za-z0-9_-]{10,})/;
+// Credential-signalling LHS identifier.
+const SECRET_NAME = /(?:api[_-]?key|secret|token|passwd|password|pwd|credential|private[_-]?key|access[_-]?key|client[_-]?secret|auth[_-]?token)/i;
+
+// LHS ident, then `=`/`:=`/`:`, then a concat of >=2 string literals joined by
+// `+` (most langs) or `.` (PHP). Single or double quoted.
+const ASSIGN_CONCAT = /([A-Za-z_$][\w$]*)\s*(?::?=|:)\s*((?:(?:'[^'\n]*'|"[^"\n]*")\s*[+.]\s*)+(?:'[^'\n]*'|"[^"\n]*"))/g;
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+function joinLiterals(expr) {
+  const parts = expr.match(/'[^'\n]*'|"[^"\n]*"/g) || [];
+  return parts.map((p) => p.slice(1, -1)).join('');
+}
+
+export function scanSecretConcat(fp, raw) {
+  if (!/\.(?:js|jsx|ts|tsx|mjs|cjs|py|rb|go|java|kt|php|phtml|cs|scala|groovy)$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const findings = [];
+  const seen = new Set();
+
+  const re = new RegExp(ASSIGN_CONCAT.source, ASSIGN_CONCAT.flags);
+  let m;
+  while ((m = re.exec(code))) {
+    const ident = m[1];
+    const value = joinLiterals(m[2]);
+    const byPrefix = SECRET_PREFIX.test(value);
+    const byName = SECRET_NAME.test(ident) && value.length >= 24;
+    if (!byPrefix && !byName) continue;
+    const line = lineOf(code, m.index);
+    const id = `secret-concat:${fp}:${line}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line,
+      vuln: 'Hardcoded credential — secret split across concatenated literals to evade detection',
+      severity: 'high', cwe: 'CWE-798', family: 'secret', parser: 'SECRET-CONCAT', confidence: 0.78,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Load the secret from the environment or a secrets manager (process.env / os.environ / Vault / AWS Secrets Manager). Splitting the literal across a concatenation does not protect it — rotate the exposed value, it must be considered compromised.',
+    });
+  }
+  return findings;
+}

package/src/sast/ssrf-cloud-metadata.js

@@ -21,6 +21,13 @@ const SSRF_CLIENT_RE = /\b(?:fetch|axios\.\w+|requests\.\w+|http\.get|http\.requ
 
 const METADATA_GUARD_RE = /(?:169\.254\.169\.254|169\.254\.|metadata\.google\.internal|metadata\.azure\.com|fd00:ec2|metadata\.aws\.amazon)/i;
 
+// A metadata literal that appears inside an allow/deny-list or a host
+// comparison is a GUARD (the remediation), not an SSRF — e.g.
+// `DENY = Set.of("169.254.169.254", …)`, `if (u.Host == "169.254.169.254")
+// throw`, `host !in setOf("169.254.169.254")`, `["169.254.169.254"].includes`.
+// Flagging it makes the scanner cry wolf on correctly-hardened code.
+const METADATA_GUARD_CONTEXT_RE = /\b(?:deny|denylist|blocklist|blocked?|allow(?:list|ed)?|forbidden|reject(?:ed)?|disallow|banned?)\b|[!=]==?\s*['"]|\.equals\s*\(|\.contains\b|\.includes\b|\.indexOf\b|\bin\s+\w|\bnot\s+in\b|!in\b|Set\s*\.\s*of|setOf|new\s+HashSet|\bthrow\b|SecurityException|\babort\b|getHost\s*\(|\.host\b|\.Host\b/i;
+
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
 
 export function scanSSRFCloudMetadata(fp, raw) {
@@ -37,6 +44,12 @@ export function scanSSRFCloudMetadata(fp, raw) {
     let m;
     while ((m = r.exec(code))) {
       const line = lineOf(raw, m.index);
+      // Guard recognition: if the metadata literal sits in an allow/deny-list
+      // or host-comparison (this line ± 1), it's blocking the endpoint, not
+      // calling it — suppress the false positive on hardened code.
+      const lines = raw.split('\n');
+      const ctx = lines.slice(Math.max(0, line - 2), line + 1).join('\n');
+      if (METADATA_GUARD_CONTEXT_RE.test(ctx)) continue;
       push({
         id: `ssrf-meta-hardcoded:${fp}:${line}`,
         file: fp, line,