@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

package/src/sast/java-structural.js

@@ -0,0 +1,81 @@
+// Java structural (taint-independent) injection detectors — PRD Tier 1.
+//
+// The flow-based Java modules miss standalone DAO/handler methods whose
+// tainted-by-convention parameter has no in-file source. Java has no string
+// templates, so the injection shape is string CONCATENATION (`"…" +`) into a
+// dangerous sink — which is itself the vulnerability regardless of the
+// variable's name. Parameterized statements / canonicalized paths / host-
+// guarded URLs do not match, keeping this high-precision.
+
+import { blankComments } from './_comment-strip.js';
+
+// Concat-into-sink families with no guard needed (parameterized form has no
+// string-concat argument, so it auto-clears).
+const RE = {
+  sqlInjection: /\b(?:executeQuery|executeUpdate|execute|createQuery|createNativeQuery|prepareStatement|prepareCall)\s*\(\s*"[^"\n]*"\s*\+/g,
+  cmdInjection: /\b(?:Runtime\.getRuntime\(\)\s*\.\s*exec|ProcessBuilder)\s*\(\s*(?:new\s+String\s*\[\s*\]\s*\{\s*)?"[^"\n]*"\s*\+/g,
+};
+
+const META = {
+  sqlInjection: {
+    vuln: 'SQL Injection — query built with string concatenation (Java)',
+    severity: 'critical', cwe: 'CWE-89',
+    remediation: 'Use a PreparedStatement with bind parameters: prepareStatement("… WHERE name = ?") then setString(1, name). Never concatenate values into SQL.',
+  },
+  cmdInjection: {
+    vuln: 'Command Injection — exec built with string concatenation (Java)',
+    severity: 'critical', cwe: 'CWE-78',
+    remediation: 'Use ProcessBuilder with an argument array (no shell): new ProcessBuilder("cmd", arg1, arg2). Never concatenate input into a command string.',
+  },
+};
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+export function scanJavaStructural(fp, raw) {
+  if (!/\.java$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const findings = [];
+  const seen = new Set();
+  const push = (f) => { if (!seen.has(f.id)) { seen.add(f.id); findings.push(f); } };
+  const emit = (key, line, meta) => push({
+    id: `java-struct-${key}:${fp}:${line}`, file: fp, line,
+    vuln: meta.vuln, severity: meta.severity, cwe: meta.cwe, family: meta.family,
+    snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+    remediation: meta.remediation, parser: 'JAVA', confidence: 0.78,
+  });
+
+  for (const [key, re] of Object.entries(RE)) {
+    const r = new RegExp(re.source, re.flags);
+    let m;
+    while ((m = r.exec(code))) emit(key, lineOf(code, m.index), META[key]);
+  }
+
+  // Path traversal (CWE-22): a file path built by concatenation, unless the
+  // file canonicalizes / normalizes / range-checks the path.
+  const PATH_SINK = /\bnew\s+(?:File|FileInputStream|FileReader|FileOutputStream|RandomAccessFile)\s*\(\s*"[^"\n]*"\s*\+|\bPaths\.get\s*\(\s*"[^"\n]*"\s*\+/;
+  const PATH_GUARD = /getCanonicalPath|toRealPath|\.normalize\s*\(\s*\)|\bstartsWith\s*\(|FilenameUtils|\.isAbsolute\s*\(/;
+  if (PATH_SINK.test(code) && !PATH_GUARD.test(code)) {
+    const line = lineOf(code, code.search(PATH_SINK));
+    emit('path', line, {
+      vuln: 'Path Traversal — file path built with string concatenation (Java)',
+      severity: 'high', cwe: 'CWE-22',
+      remediation: 'Resolve against an allow-listed base and verify containment: Path want = base.resolve(name).normalize().toRealPath(); if (!want.startsWith(base)) throw …',
+    });
+  }
+
+  // SSRF (CWE-918): new URL/URI opened from a non-literal/templated value,
+  // unless a host allow/deny guard is present.
+  const SSRF_SINK = /\bnew\s+(?:URL|URI)\s*\(\s*(?:[A-Za-z_]\w*\s*\)|"[^"\n]*"\s*\+)/;
+  const SSRF_GUARD = /169\.254\.169\.254|getHost\s*\(\s*\)|allow(?:ed)?Hosts?|isLoopback|isSiteLocal|isLinkLocal|InetAddress|\bDENY\b|deny(?:list)?|block(?:list|ed)/i;
+  if (SSRF_SINK.test(code) && !SSRF_GUARD.test(code)) {
+    const line = lineOf(code, code.search(SSRF_SINK));
+    emit('ssrf', line, {
+      vuln: 'SSRF — URL/URI opened from a non-literal value (Java)',
+      severity: 'high', cwe: 'CWE-918',
+      remediation: 'Resolve the host and reject RFC1918 / link-local / metadata (169.254.169.254) addresses, or use an allow-list, before opening the connection.',
+    });
+  }
+
+  return findings;
+}

package/src/sast/js-framework-structural.js

@@ -0,0 +1,115 @@
+// JS/TS framework structural detectors — PRD Tier 1 (JS/Python recall).
+//
+// The weakest languages (JS/Python) miss framework-handler shapes where user
+// input arrives via a framework source (@Query, ctx.query, req.query) and is
+// concatenated into a sink. Taint-independent structural rules close them.
+// SSRF/path findings (CWE-918/CWE-22) are emitted here too; the centralized
+// guard pass (engine.js dropGuardedFindings) handles their hardened forms.
+
+import { blankComments } from './_comment-strip.js';
+
+const JS_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+// Skip an XSS finding when the value is HTML-escaped on the same line.
+const XSS_ESCAPE = /\b(?:escape|escapeHtml|escape_html|sanitize|sanitizeHtml|DOMPurify\.sanitize|he\.encode|he\.escape|_\.escape|encodeURIComponent|xss)\s*\(/;
+// Skip prototype pollution when the file filters forbidden keys.
+const PROTO_GUARD = /(?:__proto__|constructor|prototype|FORBIDDEN_KEYS|DANGEROUS_KEYS|blocked?Keys)\b[\s\S]{0,80}?(?:continue|delete|\.has\s*\(|new\s+Set|\.includes\s*\(|skip|filter|reject|block|throw|return)/;
+
+export function scanJsFrameworkStructural(fp, raw) {
+  if (!JS_RE.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+  const emit = (key, line, meta) => {
+    const id = `js-fw-${key}:${fp}:${line}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line, vuln: meta.vuln, severity: meta.severity, cwe: meta.cwe,
+      family: meta.family, parser: 'JS-FW', confidence: meta.confidence ?? 0.7,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200), remediation: meta.remediation,
+    });
+  };
+
+  // True when `idx` falls inside a string literal on its own line — i.e. an odd
+  // number of unescaped quotes of some kind precede it. Used to skip a `.query(`
+  // that is itself the CONTENT of a string (e.g. a rule-definition's
+  // `example: "db.query(\`…\`)"`), which is data, not a call.
+  const _insideStringLiteral = (idx) => {
+    const lineStart = code.lastIndexOf('\n', idx - 1) + 1;
+    const prefix = code.slice(lineStart, idx);
+    for (const q of ['"', "'"]) {
+      const n = (prefix.match(new RegExp(`(?<!\\\\)${q}`, 'g')) || []).length;
+      if (n % 2 === 1) return true;
+    }
+    return false;
+  };
+
+  // SQL Injection: db.query/.execute/.raw with template-literal ${} or concat.
+  // (TypeORM Connection.query, mysql connection.query, etc.)
+  const SQL_RE = /\.(?:query|execute|raw|prepare)\s*\(\s*(?:`[^`\n]*\$\{|"[^"\n]*"\s*\+|'[^'\n]*'\s*\+|"[^"\n]*\$\{)/g;
+  let m;
+  while ((m = SQL_RE.exec(code))) {
+    if (_insideStringLiteral(m.index)) continue;
+    emit('sqli', lineOf(code, m.index), {
+      vuln: 'SQL Injection — query built with template literal / concat (JS/TS)',
+      severity: 'critical', cwe: 'CWE-89', family: 'sql-injection', confidence: 0.75,
+      remediation: 'Use parameterized queries — pass `?`/`$1` placeholders and a values array (e.g. `conn.query("… WHERE name = ?", [name])`). Never interpolate or concatenate values into SQL.',
+    });
+  }
+
+  // NestJS / axios HttpService SSRF: http(.|Service|Client).get(<non-literal>).
+  const SSRF_RE = /\b(?:http|httpService|httpClient|axios)\s*\.\s*(?:get|post|put|patch|delete|request)\s*\(\s*[A-Za-z_$][\w$.]*\s*[),]/g;
+  while ((m = SSRF_RE.exec(code))) emit('ssrf', lineOf(code, m.index), {
+    vuln: 'SSRF — HTTP client request to a non-literal URL (JS/TS)',
+    severity: 'high', cwe: 'CWE-918', family: 'ssrf', confidence: 0.55,
+    remediation: 'Validate the URL host against an allow-list and reject RFC1918 / link-local / metadata (169.254.169.254) addresses before requesting.',
+  });
+
+  // Koa path traversal: koa-send with a user-controlled path.
+  const KOA_PATH_RE = /\bsend\s*\(\s*ctx\s*,\s*ctx\s*\.\s*(?:query|params|request)\b/g;
+  while ((m = KOA_PATH_RE.exec(code))) emit('koa-path', lineOf(code, m.index), {
+    vuln: 'Path Traversal — koa-send with user-controlled path',
+    severity: 'high', cwe: 'CWE-22', family: 'path-traversal', confidence: 0.6,
+    remediation: 'Resolve against an allow-listed root and reject paths that escape it; koa-send `root` alone does not stop `..` in all versions. Use `path.basename` or a canonicalize+containment check.',
+  });
+
+  // Koa reflected XSS: ctx.body assigned from ctx.query/params (unless escaped).
+  const KOA_XSS_RE = /ctx\s*\.\s*body\s*=\s*([^;\n]*\bctx\s*\.\s*(?:query|params|request)\b[^;\n]*)/g;
+  while ((m = KOA_XSS_RE.exec(code))) {
+    if (XSS_ESCAPE.test(m[1])) continue;
+    emit('koa-xss', lineOf(code, m.index), {
+      vuln: 'Reflected XSS — ctx.body built from user input without encoding (Koa)',
+      severity: 'high', cwe: 'CWE-79', family: 'xss', confidence: 0.65,
+      remediation: 'HTML-encode user input before placing it in the response body (e.g. `escape-html`), or render via a template engine with auto-escaping.',
+    });
+  }
+
+  // XXE: libxmljs parse with entity expansion / DTD loading enabled
+  // (`noent: true`, `dtdload: true`, `replaceEntities: true`). These options
+  // turn an external-entity reference in attacker XML into file read / SSRF.
+  const XXE_RE = /\bparse(?:XmlString|Xml|FromString|XmlAsync)?\s*\([^)]*\b(?:noent|dtdload|dtdvalid|replaceEntities|external|expandEntities)\s*:\s*(?:true|1)\b/g;
+  while ((m = XXE_RE.exec(code))) emit('xxe', lineOf(code, m.index), {
+    vuln: 'XXE — XML parsed with entity expansion / DTD loading enabled (libxmljs)',
+    severity: 'high', cwe: 'CWE-611', family: 'xxe', confidence: 0.7,
+    remediation: 'Parse with entity expansion and DTD loading OFF — drop `noent`/`dtdload`/`replaceEntities` (they default to false). Untrusted XML with external entities enabled allows local file read and SSRF.',
+  });
+
+  // Prototype pollution: a deep-merge/extend of req/ctx user input, unless the
+  // file filters __proto__/constructor/prototype keys.
+  const PROTO_RE = /\b(?:deepMerge|deepExtend|mergeDeep|defaultsDeep|mergeWith|_\.merge|merge|extend|assignIn)\s*\([^)\n]*\b(?:req|request|ctx)\s*\.\s*(?:body|query|params)\b/g;
+  const fileFiltersProto = PROTO_GUARD.test(code);
+  while ((m = PROTO_RE.exec(code))) {
+    if (fileFiltersProto) continue;
+    emit('proto', lineOf(code, m.index), {
+      vuln: 'Prototype Pollution — user input deep-merged without key filtering',
+      severity: 'critical', cwe: 'CWE-1321', family: 'prototype-pollution', confidence: 0.6,
+      remediation: 'Reject `__proto__`, `constructor`, and `prototype` keys before merging, or use a Map / Object.create(null) / structuredClone. Avoid merging request bodies into existing objects.',
+    });
+  }
+
+  return findings;
+}

package/src/sast/kotlin.js

@@ -18,6 +18,15 @@ const RE = {
   exec: /\bRuntime\.getRuntime\(\)\s*\.\s*exec\s*\(\s*[^)]*\b(?:request|req|input|params|userInput)\b/g,
   gsonPolymorphic: /\bGson\(\)\s*\.\s*fromJson\s*\(\s*[^,)]+,\s*(?:Any::class|Object::class)/g,
   fileReadText: /\bFile\s*\(\s*[^)]*\b(?:request|req|input|userInput|params)\b[^)]*\)\s*\.\s*read(?:Text|Bytes|Lines)/g,
+  // Structural (taint-independent) detectors: a dangerous sink built with a
+  // Kotlin string template (`${x}` / `$x`) or string concatenation (`"…" +`)
+  // is the injection shape regardless of the variable's name — parameterized
+  // queries / array-form exec / canonicalized paths never interpolate. A pure
+  // string literal (no template, no concat) does NOT match, so this stays
+  // high-precision and complements the taint engine (which needs a source).
+  sqlInjection: /\b(?:executeQuery|executeUpdate|prepareStatement|prepareCall|createQuery|createNativeQuery|nativeQuery|rawQuery)\s*\(\s*"[^"\n]*(?:\$\{?[A-Za-z_]|"\s*\+)/g,
+  cmdInjectionStructural: /\b(?:Runtime\.getRuntime\(\)\s*\.\s*exec|ProcessBuilder)\s*\(\s*(?:listOf\s*\(\s*)?"[^"\n]*(?:\$\{?[A-Za-z_]|"\s*\+)/g,
+  pathTraversalStructural: /\b(?:File|FileInputStream|FileReader|FileOutputStream|RandomAccessFile|Paths\.get)\s*\(\s*"[^"\n]*(?:\$\{?[A-Za-z_]|"\s*\+)/g,
 };
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -66,6 +75,21 @@ export function scanKotlin(fp, raw) {
           severity: 'high', cwe: 'CWE-22',
           remediation: 'Canonicalize and verify the path is within an allowed base directory before reading: `if (!File(path).canonicalPath.startsWith(baseDir.canonicalPath)) throw ...`. Better: store files by content-hash filenames generated server-side and let the client request by hash, never by user-supplied path.',
         },
+        sqlInjection: {
+          vuln: 'SQL Injection — query built with a Kotlin string template / concat (Kotlin)',
+          severity: 'critical', cwe: 'CWE-89',
+          remediation: 'Use a parameterized query: `prepareStatement("… WHERE name = ?")` then `setString(1, name)`. Never interpolate (`${…}`) or concatenate untrusted values into SQL.',
+        },
+        cmdInjectionStructural: {
+          vuln: 'Command Injection — exec built with a string template / concat (Kotlin)',
+          severity: 'critical', cwe: 'CWE-78',
+          remediation: 'Use `ProcessBuilder(listOf("cmd", arg1, arg2))` (array form) so no shell parses the string. Never concatenate or interpolate input into a command string.',
+        },
+        pathTraversalStructural: {
+          vuln: 'Path Traversal — file path built with a string template / concat (Kotlin)',
+          severity: 'high', cwe: 'CWE-22',
+          remediation: 'Canonicalize and assert the path stays within an allow-listed base dir before opening: `require(File(base, name).canonicalPath.startsWith(File(base).canonicalPath))`. Do not interpolate untrusted segments into a path.',
+        },
       }[key];
       push({
         id: `kotlin-${key}:${fp}:${line}`,
@@ -78,5 +102,53 @@ export function scanKotlin(fp, raw) {
       });
     }
   }
+  // XXE (CWE-611): an XML factory that parses without DTD/external-entity
+  // hardening. Flag only when no secure-processing config is present anywhere
+  // in the file (so the fixed form with setFeature(...) is not flagged).
+  const XXE_FACTORY = /\b(?:DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|SAXReader|XMLReaderFactory|TransformerFactory)\b/;
+  const XXE_PARSE = /\.(?:parse|newDocumentBuilder|newSAXParser|createXMLStreamReader|read)\s*\(/;
+  const XXE_GUARD = /setFeature|disallow-doctype-decl|external-general-entities|external-parameter-entities|FEATURE_SECURE_PROCESSING|setExpandEntityReferences\s*\(\s*false|ACCESS_EXTERNAL_DTD|XMLConstants/i;
+  if (XXE_FACTORY.test(code) && XXE_PARSE.test(code) && !XXE_GUARD.test(code)) {
+    const idx = code.search(XXE_FACTORY);
+    const line = lineOf(code, idx);
+    push({
+      id: `kotlin-xxe:${fp}:${line}`, file: fp, line,
+      vuln: 'XXE — XML parser without DTD/external-entity hardening (Kotlin)',
+      severity: 'high', cwe: 'CWE-611',
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Disable DTDs/external entities: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) and external-general-entities=false, or set XMLConstants.FEATURE_SECURE_PROCESSING.',
+      parser: 'KOTLIN', confidence: 0.6,
+    });
+  }
+  // SSRF (CWE-918): URL/URI opened from a non-literal or templated value,
+  // unless a host-validation guard (allow/deny-list, RFC1918/metadata check)
+  // is present in the file — the fixed form keeps URL(var) but adds the check.
+  const SSRF_SINK = /\b(?:URL|URI|HttpURLConnection)\s*\(\s*(?:"[^"\n]*\$\{?[A-Za-z_]|[A-Za-z_]\w*\s*\))/;
+  const SSRF_GUARD = /\.host\b[^\n]*\b(?:in|!in)\b|allow(?:ed)?Hosts?|isLoopback|isSiteLocal|isLinkLocal|169\.254\.169\.254|require\s*\([^)]*\bhost\b|InetAddress|block(?:list|ed)|denylist/i;
+  if (SSRF_SINK.test(code) && !SSRF_GUARD.test(code)) {
+    const idx = code.search(SSRF_SINK);
+    const line = lineOf(code, idx);
+    push({
+      id: `kotlin-ssrf:${fp}:${line}`, file: fp, line,
+      vuln: 'SSRF — URL/URI opened from a non-literal or templated value (Kotlin)',
+      severity: 'high', cwe: 'CWE-918',
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Resolve the host and reject RFC1918 / link-local / metadata (169.254.169.254) addresses before opening the connection, or restrict to an allow-list of hosts.',
+      parser: 'KOTLIN', confidence: 0.55,
+    });
+  }
+  // Insecure deserialization (CWE-502): native ObjectInputStream.readObject.
+  if (/\bObjectInputStream\s*\(/.test(code) && /\.\s*readObject\s*\(/.test(code)) {
+    const idx = code.search(/\bObjectInputStream\s*\(/);
+    const line = lineOf(code, idx);
+    push({
+      id: `kotlin-deser:${fp}:${line}`, file: fp, line,
+      vuln: 'Insecure Deserialization — ObjectInputStream.readObject on untrusted data (Kotlin)',
+      severity: 'high', cwe: 'CWE-502',
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Never deserialize untrusted data with native Java/Kotlin serialization. Use a typed format (kotlinx.serialization, Jackson with a fixed type, protobuf); if unavoidable, install a strict ObjectInputFilter allow-list.',
+      parser: 'KOTLIN', confidence: 0.6,
+    });
+  }
   return findings;
 }

package/src/sast/ldap-injection.js

@@ -12,33 +12,82 @@ import { blankComments } from './_comment-strip.js';
 //   - Python ldap3:   conn.search(base, "(uid=" + name + ")")
 //   - Python python-ldap: conn.search_s(base, scope, "(uid=" + name + ")")
 //   - Python f-strings: conn.search_s(base, scope, f"(uid={name})")
+//   - PHP:            ldap_search($ds, $base, "(uid=" . $u . ")")
+//   - Go (go-ldap):   ldap.NewSearchRequest(base, ..., "(uid="+u+")", ...)
+//   - C# DirectorySearcher: ds.Filter = "(uid=" + u + ")"   (also $"(uid={u})")
+//   - Ruby (net-ldap): conn.search(filter: "(uid=#{u})")
+//   - Kotlin JNDI:    ctx.search(base, "(uid=" + u + ")")
 //
 // We require an LDAP context hint in the file (DirContext, javax.naming,
-// ldap.initialize, ldapjs, etc.) so we don't fire on every `"foo=" + bar`
-// concatenation in unrelated code.
+// ldap.initialize, ldapjs, ldap_search, go-ldap, DirectorySearcher, Net::LDAP,
+// etc.) so we don't fire on every `"foo=" + bar` concatenation in unrelated
+// code.
 
+// LDAP filter attributes that strongly imply an LDAP filter (not a generic
+// key=value string). Shared across all language patterns.
+const ATTR = '(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf|userPrincipalName|distinguishedName|ou)';
+
+// Path A — concatenation/interpolation INSIDE (or adjacent to) the sink call.
+// High-confidence; does not need the file-level context hint.
 const FILTER_INLINE_RE = {
-  // Filter string concatenated INSIDE the .search call.
-  js:   /\bfilter\s*:\s*[`"']?\([^`"')]*\b(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=\s*[`"']?\s*(?:\+|\$\{)/g,
-  java: /\.search(?:_s)?\s*\(\s*[^,]+,\s*"[^"]*\b(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=[^"]*"\s*\+\s*\w+/g,
-  py:   /\.(?:search|search_s|search_ext|paged_search)\s*\([^)]*\b(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=[^)]*['"]?\s*\+\s*\w+/g,
+  js:   new RegExp(String.raw`\bfilter\s*:\s*[` + '`' + String.raw`"']?\([^` + '`' + String.raw`"')]*\b` + ATTR + String.raw`\s*=\s*[` + '`' + String.raw`"']?\s*(?:\+|\$\{)`, 'g'),
+  java: new RegExp(String.raw`\.search(?:_s)?\s*\(\s*[^,]+,\s*"[^"]*\b` + ATTR + String.raw`\s*=[^"]*"\s*\+\s*\w+`, 'g'),
+  py:   new RegExp(String.raw`\.(?:search|search_s|search_ext|paged_search)\s*\([^)]*\b` + ATTR + String.raw`\s*=[^)]*['"]?\s*\+\s*\w+`, 'g'),
+  php:  new RegExp(String.raw`\bldap_(?:search|list|read)\s*\([^)]*\(\s*` + ATTR + String.raw`\s*=[^)]*["']\s*\.\s*\$`, 'g'),
+  go:   new RegExp(String.raw`\b(?:NewSearchRequest|SearchRequest|Search)\s*\([^)]*"\(\s*` + ATTR + String.raw`\s*=[^"]*"\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
+  // C#: DirectorySearcher.Filter assigned a concat ("(uid=" + u) or an
+  // interpolated string ($"(uid={u})").
+  cs:   new RegExp(String.raw`\bFilter\s*=\s*\$?@?"[^"]*\(\s*` + ATTR + String.raw`\s*=[^"]*(?:"\s*\+|\{)`, 'g'),
+  // Ruby net-ldap: a filter built with #{} interpolation inside a search/
+  // construct/filter call.
+  rb:   new RegExp(String.raw`\.(?:search|filter|construct|equals)\s*\([^)]*\(\s*` + ATTR + String.raw`\s*=[^)]*#\{`, 'g'),
+  kt:   new RegExp(String.raw`\.search\s*\(\s*[^,]+,\s*"[^"]*\b` + ATTR + String.raw`\s*=[^"]*"\s*\+\s*\w+`, 'g'),
 };
 
-// Filter built in a variable then passed to .search. The signal is the
-// "(<attr>= + " pattern anywhere in the file.
-const FILTER_VAR_RE =
-  /["'`]\s*\(\s*(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=\s*["'`]?\s*\+\s*[A-Za-z_][\w.]*|f["']\s*\(\s*(?:uid|cn|mail|sAMAccountName|givenName|sn|memberOf)\s*=\s*\{/g;
+// Path B — filter built in a variable then passed to the sink. Lower-
+// confidence, so gated on the file-level LDAP hint. Per-language because the
+// concat operator differs: `+` (js/java/py/go/cs/kt), `.` (php), `#{` (rb),
+// and interpolation forms (`${`, `f"…{`, `$"…{`).
+// `(?![\w.]*\s*\()` after the concat operand: a value immediately followed by `(`
+// is a function CALL (e.g. `ldap.EscapeFilter(u)`, `escape_filter_chars(u)`),
+// which is the *escaped* (safe) form — must not match.
+const FILTER_VAR_RE = {
+  js:   new RegExp(String.raw`["'` + '`' + String.raw`]\s*\(\s*` + ATTR + String.raw`\s*=\s*["'` + '`' + String.raw`]?\s*(?:\+|\$\{)\s*[A-Za-z_$][\w.]*(?![\w.]*\s*\()`, 'g'),
+  java: new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
+  py:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()|[fF]["']\s*\(\s*` + ATTR + String.raw`\s*=\s*\{`, 'g'),
+  php:  new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\.\s*\$[A-Za-z_]\w*`, 'g'),
+  go:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
+  cs:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()|\$"[^"]*\(\s*` + ATTR + String.raw`\s*=\s*\{`, 'g'),
+  rb:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=[^"']*#\{`, 'g'),
+  kt:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*(?:\+|\$\{)\s*[A-Za-z_$][\w.]*(?![\w.]*\s*\()`, 'g'),
+};
 
 // LDAP context hint: at least one of these must be in the file before we
 // trust the variable-form heuristic.
 const LDAP_HINT_RE =
-  /\b(?:DirContext|javax\.naming|ldap\.initialize|ldap3|ldapjs|LdapContext|InitialDirContext|SearchResult|conn\.search|client\.search|\.search_s|getLdapTemplate)\b/;
+  /\b(?:DirContext|javax\.naming|ldap\.initialize|ldap3|ldapjs|LdapContext|InitialDirContext|SearchResult|conn\.search|client\.search|\.search_s|getLdapTemplate|ldap_search|ldap_list|ldap_read|ldap_connect|ldap_bind|go-ldap|NewSearchRequest|DirectorySearcher|DirectoryEntry|System\.DirectoryServices|Net::LDAP|net\/ldap)\b/;
+
+// An LDAP filter-escape API applied in the file. When the value reaching a
+// filter is escaped, the metacharacter-injection risk is removed. We can't see
+// which variable on the sink line was escaped (escape-then-use spans lines —
+// e.g. PHP `$uid = ldap_escape(...); ... "(uid=" . $uid . ")"`), and the
+// inline call-guard only catches escape applied AT the concat. So when an
+// escape API is present in the file we suppress the lower-confidence finding —
+// matching the file-level guard-recognition style used elsewhere. Anchored on
+// real escape APIs so it doesn't over-suppress.
+const LDAP_ESCAPE_RE =
+  /\b(?:ldap_escape|EscapeFilter|escape_filter_chars|escapeForLDAP|encodeForLDAP|escapeLDAPSearchFilter|LDAP_ESCAPE_FILTER)\b|\bNet::LDAP::Filter\b|\bEqualityFilter\b|\bfilters\.\w+\b/;
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
 function _lang(fp) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) return 'js';
   if (/\.java$/i.test(fp)) return 'java';
   if (/\.py$/i.test(fp)) return 'py';
+  if (/\.(?:php|phtml)$/i.test(fp)) return 'php';
+  if (/\.go$/i.test(fp)) return 'go';
+  if (/\.cs$/i.test(fp)) return 'cs';
+  if (/\.rb$/i.test(fp)) return 'rb';
+  if (/\.kt$/i.test(fp)) return 'kt';
   return null;
 }
 
@@ -56,7 +105,10 @@ function _emit(fp, raw, line, why) {
       'Node ldapjs: `new EqualityFilter({ attribute: "uid", value: name })`. ' +
       'Java JNDI: bind via search filter args — `ctx.search(base, "(uid={0})", new Object[]{ name }, controls)`. ' +
       'Python python-ldap: `ldap.filter.escape_filter_chars(name)`. ' +
-      'Python ldap3: pass the value through a Connection bind-format helper.',
+      'PHP: `ldap_escape($name, "", LDAP_ESCAPE_FILTER)`. ' +
+      'Go go-ldap: `ldap.EscapeFilter(name)`. ' +
+      'C#: set `DirectorySearcher` with an escaped value or use parameterized binding. ' +
+      'Ruby net-ldap: `Net::LDAP::Filter.eq("uid", name)` instead of interpolating.',
     parser: 'LDAP-INJECTION',
     confidence: 0.85,
   };
@@ -66,12 +118,16 @@ export function scanLDAPInjection(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const lang = _lang(fp);
   if (!lang) return [];
-  const code = blankComments(raw, lang === 'py' ? 'py' : undefined);
+  const code = blankComments(raw, (lang === 'py' || lang === 'rb') ? 'py' : undefined);
   const findings = [];
   const seen = new Set();
+  // Escape-then-use: if the file applies an LDAP escape API, the filter value
+  // is sanitized before substitution — suppress (recall-safe per the corpus
+  // post/ pairs, which are the invariant proving this doesn't drop a real TP).
+  const escaped = LDAP_ESCAPE_RE.test(code);
   // Path A — concatenation inside the .search call. High-confidence,
-  // doesn't need the context hint.
-  {
+  // doesn't need the context hint (but still skip when the file escapes).
+  if (!escaped) {
     const re = new RegExp(FILTER_INLINE_RE[lang].source, FILTER_INLINE_RE[lang].flags);
     let m;
     while ((m = re.exec(code))) {
@@ -85,8 +141,8 @@ export function scanLDAPInjection(fp, raw) {
   // Path B — filter built into a variable then passed downstream. Lower-
   // confidence so we gate on a file-level LDAP hint to suppress unrelated
   // string concatenations.
-  if (LDAP_HINT_RE.test(code)) {
-    const re = new RegExp(FILTER_VAR_RE.source, FILTER_VAR_RE.flags);
+  if (!escaped && LDAP_HINT_RE.test(code)) {
+    const re = new RegExp(FILTER_VAR_RE[lang].source, FILTER_VAR_RE[lang].flags);
     let m;
     while ((m = re.exec(code))) {
       const line = lineOf(raw, m.index);

package/src/sast/open-redirect.js

@@ -33,11 +33,20 @@ const PATTERNS = [
   ['java', /\bnew\s+RedirectView\s*\(\s*(\w[\w.]*)\s*\)/g, 'Spring RedirectView'],
   // PHP header("Location: " . $...)
   ['php', /\bheader\s*\(\s*['"]\s*Location\s*:\s*['"]\s*\.\s*(\$\w[\w\[\]'"]*)/g, 'PHP Location'],
+  // Go net/http: http.Redirect(w, r, <target>, code) — target is the 3rd arg
+  // (may contain calls/parens); status is a digit or an http.Status* constant.
+  ['go', /\bhttp\.Redirect\s*\(\s*[^,]+,\s*[^,]+,\s*([\s\S]+?)\s*,\s*(?:\d|http\.Status)/g, 'Go net/http'],
+  // Ruby on Rails: redirect_to <target> (params/var).
+  ['rb', /\bredirect_to\s+(?!.*\bonly_path:\s*true)([^\n,]+?)(?:\s+status:|\s*$|\n)/gm, 'Rails redirect_to'],
+  // C#: Response.Redirect(<target>) / return Redirect(<target>) / RedirectPermanent.
+  ['cs', /\b(?:Response\.Redirect|return\s+Redirect|return\s+RedirectPermanent|RedirectPermanent)\s*\(\s*([^)]+?)\s*\)/g, 'ASP.NET Redirect'],
+  // Kotlin/Servlet: resp.sendRedirect(<target>).
+  ['kt', /\.\s*sendRedirect\s*\(\s*([^)]+?)\s*\)/g, 'Servlet sendRedirect'],
 ];
 
 // What counts as "user-derived" inside the captured target expression.
 const TAINT_HINT_RE =
-  /\b(?:req\.|request\.|params\.|query\.|body\.|ctx\.query|ctx\.request|ctx\.params|reply\.query|r\.URL\.Query|c\.Query|next\b|_GET|_POST|_REQUEST|getParameter|getHeader)\b/;
+  /\b(?:req\.|request\.|params\.|params\s*\[|query\.|body\.|ctx\.query|ctx\.request|ctx\.params|reply\.query|r\.URL\.Query|c\.Query|c\.Param|next\b|_GET|_POST|_REQUEST|getParameter|getHeader|Request\.(?:Query|Form|Params|QueryString))\b|\b(?:params|query|cookies)\s*\[/;
 
 // What counts as an allow-list check earlier in the function. We look back
 // up to 30 lines before the redirect call for any of these patterns.
@@ -54,6 +63,12 @@ const ALLOWLIST_PATTERNS = [
   /allowedRedirectTargets/i,
   /\babort\s*\(\s*4\d\d/,                        // any abort(4xx) earlier
   /\bres\s*\.\s*status\s*\(\s*4\d\d\b/,
+  /\bin_array\s*\(/i,                            // PHP in_array(...) allow-list check
+  /\bonly_path:\s*true/,                         // Rails redirect_to …, only_path: true
+  /\bUrl\.IsLocalUrl\b|\bLocalRedirect\b/,       // ASP.NET local-only redirect
+  /\bin\s+(?:allowed|allow|ALLOWED)\b/,          // Kotlin/Ruby `next in allowed`
+  /\bstrings\.HasPrefix\s*\(\s*\w+\s*,\s*"\/"/,  // Go relative-path check
+  /\bset(?:Of)?\s*\([^)]*\)\.contains\b/,        // Kotlin allowed.contains(next)
 ];
 
 function _lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -61,10 +76,34 @@ function _lang(fp) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) return 'js';
   if (/\.py$/i.test(fp)) return 'py';
   if (/\.java$/i.test(fp)) return 'java';
-  if (/\.php$/i.test(fp)) return 'php';
+  if (/\.(?:php|phtml)$/i.test(fp)) return 'php';
+  if (/\.go$/i.test(fp)) return 'go';
+  if (/\.rb$/i.test(fp)) return 'rb';
+  if (/\.cs$/i.test(fp)) return 'cs';
+  if (/\.kt$/i.test(fp)) return 'kt';
   return null;
 }
 
+// For C#/Kotlin/Go a bare-identifier redirect target is user-derived when it is
+// a parameter of the enclosing method/handler (the single-file handler shape).
+const _PARAM_LANGS = new Set(['cs', 'kt', 'go']);
+function _isEnclosingParam(code, callIdx, target) {
+  if (!/^[A-Za-z_]\w*$/.test(target)) return false;
+  const before = code.slice(0, callIdx);
+  const sigRe = /\b(?:fun\s+\w+|func\s+\w*|[A-Za-z_][\w<>\[\],.\s]*\b\w+)\s*\(([^)]*)\)\s*(?::[^={]+|[A-Za-z_][\w.<>\[\]* ]*)?\{/g;
+  let sig = null, sm;
+  while ((sm = sigRe.exec(before)) !== null) sig = sm;
+  if (!sig) return false;
+  const params = sig[1].split(',').map((p) => {
+    const t = p.trim(); if (!t) return '';
+    if (t.includes(':')) return t.split(':')[0].trim();      // Kotlin name: Type
+    return (t.split(/\s+/)[t.includes(' ') ? (t.trim().split(/\s+/).length - 1) : 0] || '').trim();
+  });
+  // Go params are `name Type` (name first); JVM/C# are `Type name` (name last).
+  const goParams = sig[1].split(',').map((p) => (p.trim().split(/\s+/)[0] || '').trim());
+  return params.includes(target) || goParams.includes(target);
+}
+
 function _allowListedPrior(raw, callLine, target) {
   const lines = raw.split('\n');
   const lo = Math.max(0, callLine - 30);
@@ -79,8 +118,8 @@ export function scanOpenRedirect(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const lang = _lang(fp);
   if (!lang) return [];
-  const code = blankComments(raw, lang === 'py' ? 'py' : undefined);
-  if (!/\bredirect\b|RedirectView|HttpResponseRedirect|Location\s*:/i.test(code)) return [];
+  const code = blankComments(raw, (lang === 'py' || lang === 'rb') ? 'py' : undefined);
+  if (!/\bredirect|RedirectView|HttpResponseRedirect|Location\s*:|sendRedirect|http\.Redirect/i.test(code)) return [];
   const findings = [];
   const seen = new Set();
   for (const [plang, pat, framework] of PATTERNS) {
@@ -90,7 +129,10 @@ export function scanOpenRedirect(fp, raw) {
     while ((m = re.exec(code))) {
       const target = (m[1] || '').trim();
       if (!target) continue;
-      if (!TAINT_HINT_RE.test(target)) continue;
+      // Literal-string target ("/home", "https://fixed") is never user-derived.
+      if (/^["'`][^"'`]*["'`]$/.test(target)) continue;
+      if (!TAINT_HINT_RE.test(target) &&
+          !(_PARAM_LANGS.has(plang) && _isEnclosingParam(code, m.index, target))) continue;
       const line = _lineOf(raw, m.index);
       // Suppress if an allow-list check appears in the preceding window.
       if (_allowListedPrior(raw, line, target)) continue;

package/src/sast/php.js

@@ -18,6 +18,21 @@ const RE = {
   extractRequest: /\bextract\s*\(\s*\$(?:_REQUEST|_GET|_POST|HTTP_GET_VARS|HTTP_POST_VARS)\s*[,)]/g,
   passwordHashMd5: /\b(?:md5|sha1)\s*\(\s*\$(?:_(?:REQUEST|GET|POST)|password|passwd|pwd|hash_input)/gi,
   phpinfo: /\bphpinfo\s*\(/g,
+  // Structural (taint-independent): a shell or SQL sink built with string
+  // concat (`'…' .`) or double-quote `$var` interpolation is the injection
+  // shape regardless of the source token — the rules above require the literal
+  // $_REQUEST/$_GET/$_POST on the sink line, which misses framework idioms
+  // (`$f = $r->query->get('x'); shell_exec('gzip ' . $f)`).
+  cmdInjectionStructural: /\b(?:shell_exec|exec|system|passthru|popen|proc_open|pcntl_exec)\s*\(\s*(?:"[^"\n]*\$|'[^'\n]*'\s*\.|"[^"\n]*"\s*\.)/g,
+  sqlInjectionStructural: /\b(?:DB::raw|DB::select|DB::statement|DB::insert|DB::update|DB::delete|whereRaw|orWhereRaw|havingRaw|selectRaw|orderByRaw|mysqli_query|mysql_query|pg_query|pg_send_query|sqlite_query|->query|->rawQuery)\s*\(\s*(?:DB::raw\s*\(\s*)?(?:"[^"\n]*\$|"[^"\n]*"\s*\.|'[^'\n]*'\s*\.)/g,
+  // Structural path traversal: a filesystem read/write built by concatenating
+  // or interpolating into the path. Containment-guarded forms (basename) are
+  // dropped centrally by engine.js dropGuardedFindings (CWE-22).
+  pathTraversalStructural: /\b(?:readfile|file_get_contents|file_put_contents|fopen|fpassthru|fgets|file|copy|unlink|highlight_file|show_source)\s*\(\s*(?:"[^"\n]*"\s*\.|'[^'\n]*'\s*\.|"[^"\n]*\$(?:_(?:REQUEST|GET|POST|COOKIE)|[A-Za-z_]))/g,
+  // SSRF: a network fetch whose URL is user-controlled. cURL is unambiguously
+  // network; file_get_contents/fopen with a $_GET/$_POST value direct (not a
+  // path-base concat) is the PHP fopen-wrapper SSRF (http:// / ftp:// / phar://).
+  ssrfFetch: /\bcurl_init\s*\(\s*\$(?:_(?:REQUEST|GET|POST|COOKIE)|\w*url\w*)|\bcurl_setopt\s*\([^,]+,\s*CURLOPT_URL\s*,\s*\$(?:_(?:REQUEST|GET|POST|COOKIE)|\w*url\w*)|\b(?:file_get_contents|fopen)\s*\(\s*\$_(?:REQUEST|GET|POST|COOKIE)\b/g,
 };
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -75,6 +90,26 @@ export function scanPhp(fp, raw) {
           severity: 'high', cwe: 'CWE-200',
           remediation: 'Delete phpinfo() before deploy. It leaks the PHP version, loaded extensions, environment variables, document root, and request headers — a one-shot recon page for an attacker.',
         },
+        cmdInjectionStructural: {
+          vuln: 'Command Injection: shell function built with string concat / interpolation',
+          severity: 'critical', cwe: 'CWE-78',
+          remediation: 'Use the array form of proc_open(["gzip", $f], ...) so no shell parses the string, and validate inputs. Never concatenate or interpolate values into shell_exec/exec/system/passthru.',
+        },
+        sqlInjectionStructural: {
+          vuln: 'SQL Injection: raw query built with string concat / interpolation',
+          severity: 'critical', cwe: 'CWE-89',
+          remediation: 'Use parameter bindings: DB::select("SELECT … WHERE name = ?", [$name]) or the query builder with bindings. Never concatenate/interpolate into DB::raw / whereRaw / mysqli_query.',
+        },
+        pathTraversalStructural: {
+          vuln: 'Path Traversal: filesystem operation built with concatenated/interpolated input',
+          severity: 'high', cwe: 'CWE-22', family: 'path-traversal',
+          remediation: 'Strip directory components with basename() and resolve against a fixed root: $full = realpath($base . "/" . basename($name)); if (strpos($full, $base) !== 0) abort(). Never concatenate request input straight into a file path.',
+        },
+        ssrfFetch: {
+          vuln: 'SSRF: network fetch (cURL / fopen-wrapper) to a user-controlled URL',
+          severity: 'high', cwe: 'CWE-918', family: 'ssrf',
+          remediation: 'Validate the URL host against an allow-list and reject RFC1918 / link-local / metadata (169.254.169.254) addresses before fetching. Disable fopen URL wrappers (allow_url_fopen=0) and only allow https:// to known hosts.',
+        },
       }[key];
       push({
         id: `php-${key}:${fp}:${line}`,