@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

package/src/sast/python-structural.js

@@ -0,0 +1,83 @@
+// Python framework structural detectors — PRD Tier 1 (JS/Python recall).
+//
+// Closes Flask/Django handler FNs where user input is concatenated into a
+// template or raw SQL. Taint-independent: the concat / f-string / %-format is
+// the injection shape. Crucially, a Jinja `{{ name }}` placeholder is SAFE
+// (auto-escaped), so `{` alone is NOT a signal — only `+`, f-strings, or
+// `.format()`/`%`.
+
+import { blankComments } from './_comment-strip.js';
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+// A string literal that may contain the *other* quote char (a SQL string like
+// `"… name = '"` embeds a single quote) — the naive `["'][^"'\n]*["']` breaks
+// on the embedded quote and misses the concat. Match each quote style with its
+// own body so embedded quotes are allowed.
+const STR = String.raw`(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')`;
+// Dynamic-string shape inside a sink call: concat (`"…" +`), f-string (`f"…"`),
+// `.format(`, or `%`-format via the `%` OPERATOR after the string (`"…%s" % v`).
+// NOT a plain literal, and NOT a `%s` placeholder followed by a params list —
+// `execute("… %s", [v])` is the SAFE parameterized DB-API form.
+const DYN = String.raw`(?:[fF]["']|${STR}\s*\+|${STR}\s*%\s*[(\w]|${STR}\s*\.\s*format\s*\()`;
+
+export function scanPythonStructural(fp, raw) {
+  if (!/\.py$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw, 'py');
+  const findings = [];
+  const seen = new Set();
+  const emit = (key, line, meta) => {
+    const id = `py-struct-${key}:${fp}:${line}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line, vuln: meta.vuln, severity: meta.severity, cwe: meta.cwe,
+      family: meta.family, parser: 'PYTHON', confidence: meta.confidence ?? 0.7,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200), remediation: meta.remediation,
+    });
+  };
+
+  // Flask SSTI: render_template_string built from a dynamic string. A static
+  // template with Jinja `{{ }}` placeholders is safe and must not match.
+  const SSTI_RE = new RegExp(String.raw`\brender_template_string\s*\(\s*` + DYN, 'g');
+  let m;
+  while ((m = SSTI_RE.exec(code))) emit('flask-ssti', lineOf(code, m.index), {
+    // render_template_string with a built string is both reflected XSS
+    // (unescaped user input in the rendered HTML) and template injection
+    // (`{{7*7}}` executes). Classified CWE-79 (the dominant, ground-truth
+    // taxonomy); the remediation covers the SSTI aspect too.
+    vuln: 'Reflected XSS / template injection (SSTI) via render_template_string (Flask)',
+    severity: 'critical', cwe: 'CWE-79', family: 'xss', confidence: 0.7,
+    remediation: 'Use a static template with `{{ }}` placeholders and pass values as named context (`render_template_string("Hi {{ name }}", name=name)`). Never build the template body from input.',
+  });
+
+  // Django raw SQL: .raw() / .extra() built from a dynamic string.
+  const DJ_RE = new RegExp(String.raw`\.\s*(?:raw|extra)\s*\(\s*` + DYN, 'g');
+  while ((m = DJ_RE.exec(code))) emit('django-sqli', lineOf(code, m.index), {
+    vuln: 'SQL Injection — Django raw()/extra() built with string concat / format (Python)',
+    severity: 'critical', cwe: 'CWE-89', family: 'sql-injection', confidence: 0.7,
+    remediation: 'Use the ORM with an allow-list for column/order fields, or parameterize: `User.objects.raw("… WHERE name = %s", [name])`. Never concatenate into raw SQL.',
+  });
+
+  // DB-API cursor.execute built from a dynamic string.
+  const EXEC_RE = new RegExp(String.raw`\.\s*execute(?:script)?\s*\(\s*` + DYN, 'g');
+  while ((m = EXEC_RE.exec(code))) emit('cursor-sqli', lineOf(code, m.index), {
+    vuln: 'SQL Injection — cursor.execute built with string concat / format (Python)',
+    severity: 'critical', cwe: 'CWE-89', family: 'sql-injection', confidence: 0.7,
+    remediation: 'Pass parameters as the second argument with `%s` placeholders: `cursor.execute("… WHERE id = %s", [id])`. Never concatenate or %-format values into the SQL string.',
+  });
+
+  // Path traversal: a file-open / send_file built from a dynamic string
+  // (concat / f-string / format). `open('/var/data/' + name)` is the shape;
+  // a bare literal path is not. Hardened forms (os.path.basename, secure
+  // containment) are removed by engine.js dropGuardedFindings (CWE-22).
+  const PATH_RE = new RegExp(String.raw`\b(?:open|os\.open|io\.open|codecs\.open|send_file|send_from_directory)\s*\(\s*` + DYN, 'g');
+  while ((m = PATH_RE.exec(code))) emit('path-traversal', lineOf(code, m.index), {
+    vuln: 'Path Traversal — file path built with string concat / f-string / format (Python)',
+    severity: 'high', cwe: 'CWE-22', family: 'path-traversal', confidence: 0.62,
+    remediation: 'Strip directory components and assert containment: `safe = os.path.basename(name); full = os.path.join(BASE, safe); assert os.path.realpath(full).startswith(BASE)`. Never concatenate user input straight into a file path.',
+  });
+
+  return findings;
+}

package/src/sast/rbac-consistency.js

@@ -0,0 +1,113 @@
+// R21 (PRD §5) — RBAC role-tier authorization model.
+//
+// R19 (api-authz.js) flags missing AUTHENTICATION among authenticated siblings.
+// This goes one level deeper to AUTHORIZATION TIER: it extracts the role/
+// permission a route requires (from middleware/annotations near the handler) and
+// flags two broken-access-control shapes the route inventory alone can't see:
+//   1. A state-changing route that enforces NO role while sibling routes on the
+//      same resource DO  → missing function-level authorization (BFLA).
+//   2. A state-changing route gated at a STRICTLY LOWER tier than a read sibling
+//      → privilege tier inversion (delete allowed below the tier that can read).
+//
+// Pure cross-route analysis (routes + file contents). Precision-first: fires
+// only on inconsistency within a resource group that uses roles at all.
+
+// Inline role checks — on the route's OWN registration line (middleware args).
+const INLINE_PATTERNS = [
+  /\b(?:requireRole|hasRole|hasAnyRole|checkRole|ensureRole|restrictTo|requireScope|hasAuthority|hasPermission|requirePermission)\s*\(\s*\[?\s*['"]([A-Za-z0-9_.:-]+)['"]/i,
+  /\brole\s*(?:===?|==)\s*['"]([A-Za-z0-9_.:-]+)['"]/i,
+];
+// Decorator/attribute role checks — on the line(s) directly ABOVE the handler.
+const DECORATOR_PATTERNS = [
+  /@(?:PreAuthorize|Secured|RolesAllowed)\s*\(\s*[^)]*['"]([A-Za-z0-9_.:-]+)['"]/i,
+  /\[Authorize\s*\(\s*Roles\s*=\s*"([A-Za-z0-9_.,:-]+)"/i,
+  /@(?:roles_required|permission_required)\s*\(\s*['"]([A-Za-z0-9_.:-]+)['"]/i,
+];
+
+// Coarse tier ranking (higher = more privileged). Unknown roles → tier 1 (mid).
+function tierOf(role) {
+  const r = String(role || '').toLowerCase();
+  if (/\b(super.?admin|root|owner|sysadmin)\b/.test(r) || r === 'superadmin') return 3;
+  if (/\b(admin|administrator|manager|staff|moderator|mod)\b/.test(r)) return 2;
+  if (/\b(user|member|authenticated|customer|editor|contributor)\b/.test(r)) return 1;
+  if (/\b(guest|public|anon|anonymous|viewer|reader)\b/.test(r)) return 0;
+  return 1;
+}
+
+const STATE_CHANGING = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+
+function roleOf(route, fileContents) {
+  const content = fileContents[route.file];
+  if (typeof content !== 'string') return { hasRole: false, role: null };
+  const lines = content.split('\n');
+  const idx = (route.line || 1) - 1;
+  // 1. Inline middleware / role check on the route's OWN line (don't look at
+  //    siblings — that would leak an adjacent route's role into this one).
+  const own = lines[idx] || '';
+  for (const re of INLINE_PATTERNS) { const m = own.match(re); if (m) return { hasRole: true, role: m[1] }; }
+  // 2. Stacked decorators/attributes directly ABOVE the handler; stop at the
+  //    first non-decorator line so we never cross into the previous route.
+  for (let j = idx - 1; j >= 0 && j >= idx - 4; j--) {
+    const l = (lines[j] || '').trim();
+    if (!l) continue;
+    if (/^@\w|^\[Authorize/i.test(l)) {
+      for (const re of DECORATOR_PATTERNS) { const m = l.match(re); if (m) return { hasRole: true, role: m[1] }; }
+      continue; // an unrecognized decorator — keep scanning the stack upward
+    }
+    break; // hit a non-decorator line → stop
+  }
+  return { hasRole: false, role: null };
+}
+
+// Resource key: path with dynamic segments collapsed (so /users and /users/:id
+// group together as one resource).
+function resourceKey(p) {
+  return String(p || '').split('/').map((s) => (/^(:|\{|<|\d)/.test(s) ? '*' : s)).join('/').replace(/\/\*$/, '') || '/';
+}
+
+function mk(route, kind, cwe, why) {
+  return {
+    id: `rbac:${kind}:${route.file}:${route.line}`,
+    severity: 'high',
+    file: route.file, line: route.line || 0,
+    vuln: kind === 'inversion'
+      ? 'Authorization tier inversion (state-change allowed below the read tier)'
+      : 'Missing role-based authorization on a state-changing route',
+    cwe, family: 'broken-access-control', parser: 'RBAC',
+    description: why,
+    remediation: 'Enforce a role/permission check on the route at least as strong as its sibling routes; gate state-changing actions at the appropriate privilege tier.',
+  };
+}
+
+export function scanRbacConsistency(routes, fileContents) {
+  if (!Array.isArray(routes) || routes.length < 2) return [];
+  const groups = new Map();
+  for (const r of routes) {
+    if (!r || r.path === '(file-based)' || !r.path) continue;
+    const key = `${r.file}::${resourceKey(r.path)}`;
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push({ ...r, ...roleOf(r, fileContents) });
+  }
+  const findings = [];
+  const seen = new Set();
+  const push = (f) => { const k = `${f.file}:${f.line}`; if (!seen.has(k)) { seen.add(k); findings.push(f); } };
+  for (const group of groups.values()) {
+    if (group.length < 2) continue;
+    const roled = group.filter((r) => r.hasRole);
+    if (!roled.length) continue; // resource doesn't use roles at all → not our signal
+    const maxReadTier = Math.max(...group.filter((r) => !STATE_CHANGING.has(r.method) && r.hasRole).map((r) => tierOf(r.role)), -1);
+    for (const r of group) {
+      if (!STATE_CHANGING.has(r.method)) continue;
+      if (!r.hasRole) {
+        push(mk(r, 'missing', '285',
+          `${r.method} ${r.path} enforces no role check, while ${roled.length} sibling route(s) on this resource require one — a state-changing action left at a lower authorization tier (BFLA).`));
+      } else if (maxReadTier >= 0 && tierOf(r.role) < maxReadTier) {
+        push(mk(r, 'inversion', '269',
+          `${r.method} ${r.path} requires role "${r.role}" (tier ${tierOf(r.role)}), but reading this resource requires a higher tier (${maxReadTier}). A lower-privileged user can mutate what they may not even read.`));
+      }
+    }
+  }
+  return findings;
+}
+
+export const _internals = { tierOf, resourceKey };

package/src/sast/redos-nfa.js

@@ -305,6 +305,73 @@ export function extractJavaRegexBodies(code) {
   return out;
 }
 
+// Go: regexp.MustCompile / Compile / MatchString("…") — Go string literals use
+// "…" (interpreted) or `…` (raw). Both carry the pattern verbatim.
+export function extractGoRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/\bregexp\.(?:MustCompile|Compile|CompilePOSIX|MatchString|Match)\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\bregexp\.(?:MustCompile|Compile|CompilePOSIX|MatchString|Match)\s*\(\s*`([^`]+)`/g)) {
+    out.push({ body: m[1], line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+// PHP: preg_match / preg_match_all / preg_replace("/…/flags", …) — the regex is
+// a delimited string; strip the delimiter + trailing flags.
+export function extractPhpRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/\bpreg_(?:match|match_all|replace|replace_callback|split)\s*\(\s*(['"])(.+?)\1/g)) {
+    let lit = m[2];
+    // delimited: first char is the delimiter (e.g. / # ~), trailing flags after it
+    const delim = lit[0];
+    const close = lit.lastIndexOf(delim);
+    if (close > 0) lit = lit.slice(1, close);
+    out.push({ body: lit, line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+// Ruby: a regex literal /…/ used with =~ / .match / .match? / Regexp.new("…").
+export function extractRubyRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/(?:=~|\.match\??|\.scan|\.gsub|\.sub|grep)\s*\(?\s*\/((?:\\.|[^\/\n])+)\//g)) {
+    out.push({ body: m[1], line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\bRegexp\.new\s*\(\s*['"]((?:\\.|[^'"\n])+)['"]/g)) {
+    out.push({ body: m[1], line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+// C#: new Regex("…") / Regex.IsMatch(s, "…") / Regex.Match / Regex.Replace.
+export function extractCsharpRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/\bnew\s+Regex\s*\(\s*@?"((?:\\.|""|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/""/g, '"'), line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\bRegex\.(?:IsMatch|Match|Matches|Replace|Split)\s*\(\s*[^,]+,\s*@?"((?:\\.|""|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/""/g, '"'), line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
+// Kotlin: Regex("…") / "…".toRegex() / Pattern.compile("…").
+export function extractKotlinRegexBodies(code) {
+  const out = [];
+  for (const m of code.matchAll(/\bRegex\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/"((?:\\.|[^"\n])+)"\s*\.\s*toRegex\s*\(/g)) {
+    out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
+  }
+  for (const m of code.matchAll(/\bPattern\.compile\s*\(\s*"((?:\\.|[^"\n])+)"/g)) {
+    out.push({ body: m[1].replace(/\\\\/g, '\\'), line: code.slice(0, m.index).split('\n').length });
+  }
+  return out;
+}
+
 export function scanRegexReDoS(file, raw) {
   if (!file || !raw || typeof raw !== 'string') return [];
   if (raw.length > 500_000) return [];
@@ -313,6 +380,14 @@ export function scanRegexReDoS(file, raw) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(file)) bodies = extractJsRegexBodies(raw);
   else if (/\.py$/i.test(file)) bodies = extractPyRegexBodies(raw);
   else if (/\.java$/i.test(file)) bodies = extractJavaRegexBodies(raw);
+  // NOTE: Go's regexp package uses RE2 (guaranteed linear time, no catastrophic
+  // backtracking), so Go is intentionally NOT scanned for ReDoS — a "vulnerable"
+  // pattern there is not actually exploitable. (extractGoRegexBodies is exported
+  // for completeness / third-party regexp libs but not wired into the default.)
+  else if (/\.(?:php|phtml)$/i.test(file)) bodies = extractPhpRegexBodies(raw);
+  else if (/\.rb$/i.test(file)) bodies = extractRubyRegexBodies(raw);
+  else if (/\.cs$/i.test(file)) bodies = extractCsharpRegexBodies(raw);
+  else if (/\.kt$/i.test(file)) bodies = extractKotlinRegexBodies(raw);
   else return [];
 
   for (const { body, line } of bodies) {

package/src/sast/response-splitting.js

@@ -24,25 +24,43 @@
 
 import { blankComments } from './_comment-strip.js';
 
+// Each pattern captures the header VALUE expression in its LAST group (the
+// code reads the last defined group, so header-name groups can come first).
 const PATTERNS = [
   // res.setHeader('name', val) | res.set('name', val) | ctx.response.set(…)
   ['js', /\b(?:res|reply|response|ctx\.response)\s*\.\s*(?:setHeader|set|append)\s*\(\s*[`"'][^`"']+[`"']\s*,\s*([^)]+?)\s*\)/g, 'res.setHeader'],
   // response.setHeader / response.addHeader  (Java Servlet API). Accept any
   // identifier as the receiver — `resp`, `response`, `httpResponse`, etc.
-  ['java', /\b(?:[A-Za-z_][\w]*)\s*\.\s*(?:setHeader|addHeader)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'setHeader'],
+  ['java', /\b(?:[A-Za-z_][\w]*)\s*\.\s*(?:setHeader|addHeader|addIntHeader|setDateHeader)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'setHeader'],
   // Django/Flask response.headers['X-…'] = userValue
   ['py', /\b(?:response|resp|r)\s*(?:\.\s*headers)?\s*\[\s*['"][^'"]+['"]\s*\]\s*=\s*([^\n;]+)/g, 'response.headers[…] = …'],
   // PHP header("X-Foo: " . $_GET[…])  (Location: variants handled by open-redirect)
   ['php', /\bheader\s*\(\s*['"](?!Location)([^'"]+):\s*['"]\s*\.\s*(\$\w[\w\[\]'"]*)/g, 'PHP header()'],
+  // Go net/http: w.Header().Set/Add("X-…", value) | w.Header()["X-…"] = …
+  ['go', /\.\s*Header\s*\(\s*\)\s*\.\s*(?:Set|Add)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'Header().Set'],
+  // Ruby Rack/Rails: response.headers["X-…"] = … | headers["X-…"] = … | response["X-…"] = …
+  ['rb', /\b(?:response\s*(?:\.\s*headers)?|headers)\s*\[\s*['"][^'"]+['"]\s*\]\s*=\s*([^\n;]+)/g, 'response headers[…] = …'],
+  // C#: Response.Headers.Add/Append("X-…", value) | Response.AddHeader(…) | Response.AppendHeader(…)
+  ['cs', /\bResponse\s*\.\s*(?:Headers\s*\.\s*(?:Add|Append)|AddHeader|AppendHeader)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'Response.Headers.Add'],
+  // Kotlin: resp.setHeader("X-…", value) | resp.addHeader(…) — JVM servlet API
+  ['kt', /\b(?:[A-Za-z_][\w]*)\s*\.\s*(?:setHeader|addHeader)\s*\(\s*"[^"]+"\s*,\s*([^)]+?)\s*\)/g, 'setHeader'],
 ];
 
 const TAINT_HINT_RE =
-  /\b(?:req\.|request\.|params\.|query\.|body\.|ctx\.query|ctx\.request|reply\.query|c\.Query|r\.URL\.Query|_GET|_POST|_REQUEST|getParameter|getHeader)\b/;
+  /\b(?:req\.|request\.|params\.|params\s*\[|query\.|body\.|ctx\.query|ctx\.request|reply\.query|c\.Query|r\.URL\.Query|_GET|_POST|_REQUEST|getParameter|getHeader)\b|\b(?:params|query|cookies|session)\s*\[/;
 
 const SANITIZER_PATTERNS = [
   /\.replace\s*\(\s*\/\\r\?\\?n/i,                // .replace(/\r?\n/, '')
   /\.replace\s*\(\s*\/[\[]\\r\\n[\]]/i,           // .replace(/[\r\n]/, '')
+  /\.replace\s*\(\s*['"]\\r['"]/,                 // .replace("\r", "") (Python/JS chain)
+  /\.replace\s*\(\s*['"]\\n['"]/,                 // .replace("\n", "")
   /\.replaceAll\s*\(\s*['"]\\r?\\?n?['"]/,
+  /\bgsub\s*\(\s*\/[\[]?\\r/i,                    // Ruby .gsub(/[\r\n]/, '') or /\r\n/
+  /\bgsub\s*\(\s*\/[\[]\\r\\n[\]]/i,
+  /\bdelete\s*\(\s*['"]\\r\\n['"]\s*\)/,          // Ruby .delete("\r\n")
+  /\bstrings\.NewReplacer\s*\([^)]*\\r/,          // Go strings.NewReplacer("\r","","\n","")
+  /\bstrings\.ReplaceAll\s*\([^,]+,\s*['"]\\[rn]['"]/,
+  /\bstr_replace\s*\(\s*\[[^\]]*\\[rn]/,          // PHP str_replace(["\r","\n"], …)
   /\bstripNewlines\b/i,
   /\bsanitizeHeader\b/i,
   /\bescapeCRLF\b/i,
@@ -63,7 +81,11 @@ function _lang(fp) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) return 'js';
   if (/\.py$/i.test(fp)) return 'py';
   if (/\.java$/i.test(fp)) return 'java';
-  if (/\.php$/i.test(fp)) return 'php';
+  if (/\.(?:php|phtml)$/i.test(fp)) return 'php';
+  if (/\.go$/i.test(fp)) return 'go';
+  if (/\.rb$/i.test(fp)) return 'rb';
+  if (/\.cs$/i.test(fp)) return 'cs';
+  if (/\.kt$/i.test(fp)) return 'kt';
   return null;
 }
 
@@ -79,8 +101,8 @@ export function scanResponseSplitting(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const lang = _lang(fp);
   if (!lang) return [];
-  const code = blankComments(raw, lang === 'py' ? 'py' : undefined);
-  if (!/\b(?:setHeader|addHeader|response\s*\.\s*headers|response\s*\[|reply\s*\.\s*set|\bheader\s*\()/i.test(code)) return [];
+  const code = blankComments(raw, (lang === 'py' || lang === 'rb') ? 'py' : undefined);
+  if (!/\b(?:setHeader|addHeader|addIntHeader|setDateHeader|AddHeader|AppendHeader|response\s*\.\s*headers|response\s*\[|headers\s*\[|reply\s*\.\s*set|\.\s*Header\s*\(\s*\)\s*\.\s*(?:Set|Add)|Response\s*\.\s*Headers|\bheader\s*\()/i.test(code)) return [];
   const findings = [];
   const seen = new Set();
   for (const [plang, pat, label] of PATTERNS) {
@@ -88,23 +110,30 @@ export function scanResponseSplitting(fp, raw) {
     const re = new RegExp(pat.source, pat.flags);
     let m;
     while ((m = re.exec(code))) {
-      const value = (m[1] || '').trim();
+      // Use the LAST defined capture group as the header VALUE (php's pattern
+      // captures the header NAME first, the value second).
+      const value = ((m[m.length - 1] ?? m[1]) || '').trim();
       let tainted = TAINT_HINT_RE.test(value);
-      // Java-handler-context heuristic: if the receiver looks like an
-      // HttpServletResponse and `value` is a plain ident that appears in
-      // the enclosing method's param list, treat it as user-derived. Same
-      // signature pattern as a real SAST tool's "request-scope param" rule.
-      if (!tainted && plang === 'java' && /^[A-Za-z_][\w]*$/.test(value)) {
-        const callIdx = m.index;
-        // Find the start of the enclosing method by walking back to the
-        // most recent `(...)`-style signature followed by `{`.
-        const before = code.slice(0, callIdx);
-        const sigRe = /\b(?:public|private|protected|static)[^;{]*\(([^)]*)\)\s*(?:throws[^{]+)?\{/g;
-        let sig = null;
-        let sm;
+      // Handler-context heuristic: when `value` is a plain identifier that is a
+      // parameter of the enclosing method/function, treat it as user-derived
+      // (same "request-scope param" rule a real SAST tool applies). Covers the
+      // single-file `void h(String v, … resp){ resp.setHeader("X", v); }` shape
+      // for Java / Kotlin / C#.
+      if (!tainted && (plang === 'java' || plang === 'kt' || plang === 'cs') && /^[A-Za-z_][\w]*$/.test(value)) {
+        const before = code.slice(0, m.index);
+        // Most recent signature `(...)` immediately followed by `{` — matches
+        // Java/C# (`… name(params) {`) and Kotlin (`fun name(params) … {`).
+        const sigRe = /\b(?:fun\s+\w+|[A-Za-z_][\w<>\[\],.\s]*\b\w+)\s*\(([^)]*)\)\s*(?::[^={]+)?(?:throws[^{]+)?\{/g;
+        let sig = null, sm;
         while ((sm = sigRe.exec(before)) !== null) sig = sm;
         if (sig) {
-          const params = sig[1].split(',').map(p => (p.trim().split(/\s+/).pop() || '').trim());
+          // Param name is the last token of each `Type name` / first of Kotlin `name: Type`.
+          const params = sig[1].split(',').map((p) => {
+            const t = p.trim();
+            if (!t) return '';
+            if (t.includes(':')) return t.split(':')[0].trim();      // Kotlin `name: Type`
+            return (t.split(/\s+/).pop() || '').trim();              // Java/C# `Type name`
+          });
           if (params.includes(value)) tainted = true;
         }
       }

package/src/sast/ruby.js

@@ -23,6 +23,24 @@ const RE = {
   attributesEq: /\.\s*attributes\s*=\s*params\b(?!\s*\.permit)/g,
   openSsrf: /\b(?:open|URI\.open|URI\.parse\([^)]*\)\.read)\s*\(\s*(?:params|request|@\w+\.params)\b/g,
   fileRead: /\bFile\s*\.\s*(?:read|open|new|readlines)\s*\(\s*params\s*\[/g,
+  // Structural (taint-independent): an ActiveRecord query or shell command
+  // built with string interpolation (#{...}) or concat is the injection shape
+  // regardless of whether the value is `params` or a local variable that came
+  // from params — the existing rules above require the literal `params` token
+  // on the sink line, which misses `name = params[:x]; where("... #{name}")`.
+  sqlInjectionStructural: /\.(?:where|find_by_sql|having|order|group|joins|select|from|pluck|update_all|delete_all|exec_query|execute|select_all|select_value|find_by)\s*\(\s*(?:"[^"\n]*#\{|['"][^'"\n]*['"]\s*\+)/g,
+  cmdInjectionStructural: /(?:`[^`\n]*#\{|\b(?:system|exec)\s*\(\s*"[^"\n]*#\{|\bIO\.popen\s*\(\s*"[^"\n]*#\{|\b(?:system|exec)\s*\(\s*['"][^'"\n]*['"]\s*\+)/g,
+  // Structural path traversal: File/IO op whose path is built by interpolation
+  // (#{...}) or concat. `File.read("/data/" + name)` routes through a local var
+  // so the `params[`-on-sink fileRead rule misses it. Containment-guarded forms
+  // (File.expand_path + start_with?) are dropped by engine.js dropGuardedFindings.
+  pathTraversalStructural: /\b(?:File|IO)\s*\.\s*(?:read|open|new|readlines|binread|write|foreach)\s*\(\s*(?:"[^"\n]*#\{|['"][^'"\n]*['"]\s*\+)/g,
+  // Structural deserialization (taint-independent): Marshal.load / YAML.load /
+  // YAML.unsafe_load are unsafe on ANY non-trivial argument — the danger is the
+  // sink, not the source. The `params`-on-sink marshalLoad/yamlUnsafe rules
+  // above miss `data = request.body.read; Marshal.load(data)`. A bare string
+  // literal arg (Marshal.load("...")) won't match (`\w` requires an identifier).
+  deserStructural: /\bMarshal\s*\.\s*load\s*\(\s*[A-Za-z_@]\w*|\bYAML\s*\.\s*(?:load|unsafe_load)\s*\(\s*[A-Za-z_@]\w*/g,
 };
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -92,6 +110,26 @@ export function scanRuby(fp, raw) {
           severity: 'high', cwe: 'CWE-22',
           remediation: 'Canonicalize the path and verify it stays under an allowed base: `path = File.expand_path(File.join(base, name)); raise unless path.start_with?(base)`.',
         },
+        sqlInjectionStructural: {
+          vuln: 'SQL Injection: ActiveRecord query built with string interpolation / concat',
+          severity: 'critical', cwe: 'CWE-89',
+          remediation: 'Use the parameterized form: `User.where("name = ?", name)` or `where(name: name)`. Never interpolate (`#{...}`) or concatenate values into a SQL fragment.',
+        },
+        cmdInjectionStructural: {
+          vuln: 'Command Injection: shell command built with string interpolation / concat',
+          severity: 'critical', cwe: 'CWE-78',
+          remediation: 'Use `Open3.capture2("cmd", arg1, arg2)` with separate arguments (no shell). Backticks and `system("... #{x}")` run through the shell.',
+        },
+        pathTraversalStructural: {
+          vuln: 'Path Traversal: File/IO operation built with interpolated/concatenated path',
+          severity: 'high', cwe: 'CWE-22',
+          remediation: 'Canonicalize and assert containment: `path = File.expand_path(File.join(base, name)); raise unless path.start_with?(base)`. Never interpolate/concatenate request input straight into a file path.',
+        },
+        deserStructural: {
+          vuln: 'Insecure Deserialization: Marshal.load / YAML.load on a non-literal value',
+          severity: 'critical', cwe: 'CWE-502', family: 'insecure-deserialization',
+          remediation: 'Marshal and YAML.load instantiate arbitrary Ruby objects (RCE gadget chains). Use JSON for data crossing a trust boundary, or YAML.safe_load(input, permitted_classes: [Symbol]). Never Marshal.load attacker-controlled bytes.',
+        },
       }[key];
       push({
         id: `ruby-${key}:${fp}:${line}`,

package/src/sast/secret-concat.js

@@ -0,0 +1,60 @@
+// Split-concatenation secret detector (language-agnostic) — PRD Tier 1.
+//
+// A hardcoded credential is frequently SPLIT across concatenated string
+// literals specifically to slip past secret regexes that anchor on a
+// contiguous token:  `AWS_KEY = 'AKIA' + 'IOSFODNN7EXAMPLE'`,
+// `GITHUB_TOKEN = 'ghp' + '_…'`, `STRIPE_KEY = 'sk' + '_live_…' + '…'`.
+//
+// We join the literals back together and match the *reassembled* value against
+// known provider prefixes (high precision — these markers don't occur by
+// accident) or, for a credential-named LHS, a long joined literal. The flow
+// engine and the contiguous-token secrets scanner both miss the split shape;
+// csharp-structural.js handles it for C# only. This covers JS/TS/Py/Rb/Go/
+// Java/PHP via the `+` (and PHP `.`) concat operators.
+
+import { blankComments } from './_comment-strip.js';
+
+// Real provider markers — anchored, so a generic `'foo' + 'bar'` won't match.
+const SECRET_PREFIX = /(?:sk_|sk-|AKIA|ASIA|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|xox[abprs]-|AIza|ya29\.|eyJ[A-Za-z0-9_-]{8,}|-----BEGIN|glpat-|shpat_|shpss_|npm_|dop_v1_|SG\.[A-Za-z0-9_-]{10,})/;
+// Credential-signalling LHS identifier.
+const SECRET_NAME = /(?:api[_-]?key|secret|token|passwd|password|pwd|credential|private[_-]?key|access[_-]?key|client[_-]?secret|auth[_-]?token)/i;
+
+// LHS ident, then `=`/`:=`/`:`, then a concat of >=2 string literals joined by
+// `+` (most langs) or `.` (PHP). Single or double quoted.
+const ASSIGN_CONCAT = /([A-Za-z_$][\w$]*)\s*(?::?=|:)\s*((?:(?:'[^'\n]*'|"[^"\n]*")\s*[+.]\s*)+(?:'[^'\n]*'|"[^"\n]*"))/g;
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+function joinLiterals(expr) {
+  const parts = expr.match(/'[^'\n]*'|"[^"\n]*"/g) || [];
+  return parts.map((p) => p.slice(1, -1)).join('');
+}
+
+export function scanSecretConcat(fp, raw) {
+  if (!/\.(?:js|jsx|ts|tsx|mjs|cjs|py|rb|go|java|kt|php|phtml|cs|scala|groovy)$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const findings = [];
+  const seen = new Set();
+
+  const re = new RegExp(ASSIGN_CONCAT.source, ASSIGN_CONCAT.flags);
+  let m;
+  while ((m = re.exec(code))) {
+    const ident = m[1];
+    const value = joinLiterals(m[2]);
+    const byPrefix = SECRET_PREFIX.test(value);
+    const byName = SECRET_NAME.test(ident) && value.length >= 24;
+    if (!byPrefix && !byName) continue;
+    const line = lineOf(code, m.index);
+    const id = `secret-concat:${fp}:${line}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line,
+      vuln: 'Hardcoded credential — secret split across concatenated literals to evade detection',
+      severity: 'high', cwe: 'CWE-798', family: 'secret', parser: 'SECRET-CONCAT', confidence: 0.78,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Load the secret from the environment or a secrets manager (process.env / os.environ / Vault / AWS Secrets Manager). Splitting the literal across a concatenation does not protect it — rotate the exposed value, it must be considered compromised.',
+    });
+  }
+  return findings;
+}

package/src/sast/ssrf-cloud-metadata.js

@@ -21,6 +21,13 @@ const SSRF_CLIENT_RE = /\b(?:fetch|axios\.\w+|requests\.\w+|http\.get|http\.requ
 
 const METADATA_GUARD_RE = /(?:169\.254\.169\.254|169\.254\.|metadata\.google\.internal|metadata\.azure\.com|fd00:ec2|metadata\.aws\.amazon)/i;
 
+// A metadata literal that appears inside an allow/deny-list or a host
+// comparison is a GUARD (the remediation), not an SSRF — e.g.
+// `DENY = Set.of("169.254.169.254", …)`, `if (u.Host == "169.254.169.254")
+// throw`, `host !in setOf("169.254.169.254")`, `["169.254.169.254"].includes`.
+// Flagging it makes the scanner cry wolf on correctly-hardened code.
+const METADATA_GUARD_CONTEXT_RE = /\b(?:deny|denylist|blocklist|blocked?|allow(?:list|ed)?|forbidden|reject(?:ed)?|disallow|banned?)\b|[!=]==?\s*['"]|\.equals\s*\(|\.contains\b|\.includes\b|\.indexOf\b|\bin\s+\w|\bnot\s+in\b|!in\b|Set\s*\.\s*of|setOf|new\s+HashSet|\bthrow\b|SecurityException|\babort\b|getHost\s*\(|\.host\b|\.Host\b/i;
+
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
 
 export function scanSSRFCloudMetadata(fp, raw) {
@@ -37,6 +44,12 @@ export function scanSSRFCloudMetadata(fp, raw) {
     let m;
     while ((m = r.exec(code))) {
       const line = lineOf(raw, m.index);
+      // Guard recognition: if the metadata literal sits in an allow/deny-list
+      // or host-comparison (this line ± 1), it's blocking the endpoint, not
+      // calling it — suppress the false positive on hardened code.
+      const lines = raw.split('\n');
+      const ctx = lines.slice(Math.max(0, line - 2), line + 1).join('\n');
+      if (METADATA_GUARD_CONTEXT_RE.test(ctx)) continue;
       push({
         id: `ssrf-meta-hardcoded:${fp}:${line}`,
         file: fp, line,

package/src/sast/stored-taint.js

@@ -0,0 +1,88 @@
+// Stored / second-order taint (roadmap #2) — OPT-IN.
+//
+// Classic SAST blind spot: data written to a persistence store (DB / cache /
+// file) by one request and read back by another is implicitly trusted, but if
+// any user input was ever stored there it is still attacker-controlled. The
+// result is stored XSS, second-order SQLi, etc. The engine's forward taint
+// can't see across the persistence boundary.
+//
+// This detector flags the second-order SHAPE: a value READ from a store that
+// flows into an injection sink without re-validation. It is inherently lower
+// confidence than first-order taint (stored data is not ALWAYS attacker-
+// controlled), so it is OFF by default and enabled with:
+//
+//   AGENTIC_SECURITY_STORED_TAINT=1
+//
+// Being opt-in, it cannot change default scan behavior (no default FPs/FNs).
+
+import { blankComments } from './_comment-strip.js';
+
+const JS_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const PY_RE = /\.py$/i;
+
+// A read from a persistence store, capturing the assigned variable.
+//   const row = await db.query(...)   |   row = collection.find_one(...)
+const READ_ASSIGN = [
+  /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?[\w$.]*\b(?:query|find|findOne|findById|findAll|fetchRow|fetchAll|getItem|get|scan|select|aggregate|exec)\s*\(/g,
+  /\b([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?[\w$.]*\b(?:query|find|find_one|fetchone|fetchall|first|all|get_object_or_404)\s*\(/g,
+];
+
+// Injection sinks that, fed stored data, are second-order vulnerabilities.
+function sinkPatternsFor(varName) {
+  const v = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return [
+    [new RegExp(`\\b(?:eval|exec|execSync|Function)\\s*\\([^)]*\\b${v}\\b`), 'CWE-94', 'code-injection'],
+    [new RegExp(`\\.(?:innerHTML|outerHTML)\\s*=\\s*[^;\\n]*\\b${v}\\b`), 'CWE-79', 'xss'],
+    [new RegExp(`\\bres(?:ponse)?\\s*\\.\\s*(?:send|write|end)\\s*\\([^)]*\\b${v}\\b`), 'CWE-79', 'xss'],
+    [new RegExp(`\\b(?:query|execute|raw)\\s*\\([^)]*\\b${v}\\b[^)]*\\+`), 'CWE-89', 'sql-injection'],
+    [new RegExp(`\\b(?:exec|execSync|spawn|system|popen)\\s*\\([^)]*\\b${v}\\b`), 'CWE-78', 'command-injection'],
+  ];
+}
+
+const REVALIDATED = /\b(?:validate|sanitize|escape|encode|allow(?:list|ed)|schema\.\w*parse)\b/i;
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+export function scanStoredTaint(fp, raw) {
+  if (process.env.AGENTIC_SECURITY_STORED_TAINT !== '1') return [];
+  if (!raw || raw.length > 500_000) return [];
+  if (!JS_RE.test(fp) && !PY_RE.test(fp)) return [];
+
+  const code = blankComments(raw, PY_RE.test(fp) ? 'py' : undefined);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  for (const re of READ_ASSIGN) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code))) {
+      const varName = m[1];
+      if (!varName) continue;
+      const readLine = lineOf(code, m.index);
+      // Search a forward window for the var reaching a sink, with no
+      // re-validation in between.
+      const winEnd = Math.min(lines.length, readLine + 20);
+      const window = lines.slice(readLine, winEnd).join('\n');
+      if (REVALIDATED.test(window)) continue;
+      for (const [sinkRe, cwe, family] of sinkPatternsFor(varName)) {
+        const sm = sinkRe.exec(window);
+        if (!sm) continue;
+        const sinkLine = readLine + window.substring(0, sm.index).split('\n').length;
+        const key = `${sinkLine}:${family}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        findings.push({
+          id: `stored-taint:${fp}:${sinkLine}:${family}`,
+          severity: 'medium', file: fp, line: sinkLine,
+          vuln: `Second-order / stored taint candidate (${family})`,
+          cwe, family, parser: 'SAST', confidence: 0.4,
+          description: `A value read from a persistence store ('${varName}') flows into a ${family} sink without re-validation. If any user input is ever written to that store, this is a second-order injection (e.g. stored XSS / second-order SQLi).`,
+          remediation: 'Treat data read from a store as untrusted: validate/encode it at the sink exactly as you would direct request input. Do not rely on validation performed at write time.',
+        });
+        break; // one sink class per read is enough
+      }
+    }
+  }
+  return findings;
+}