@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

package/src/sast/tree-sitter-sinks.js

@@ -0,0 +1,62 @@
+// Tree-sitter-backed sinks for long-tail languages (roadmap #8).
+//
+// First AST-accurate detector for a language that has no first-class IR parser.
+// Gated behind AGENTIC_SECURITY_TREE_SITTER=1 and the optional tree-sitter
+// dependency; when either is absent it degrades to a no-op (the existing
+// pattern detectors still run). Anchoring on real AST nodes (not regex over
+// raw text) means comments and string literals can't produce false matches.
+//
+// Rust shell-spawn command injection: a `std::process::Command` that launches a
+// shell (sh/bash/cmd/powershell) with -c / -Command AND a non-literal argument.
+// That is the classic "build a shell string from input" injection; spawning a
+// program directly (no shell) is not flagged.
+
+import { getParserFor, treeSitterLangOf, walkNamed } from '../ir/tree-sitter-loader.js';
+
+const SHELL_PROG = /Command::new\s*\(\s*[bB]?"(?:sh|bash|zsh|dash|ksh|cmd(?:\.exe)?|powershell(?:\.exe)?)"/;
+const SHELL_FLAG = /\.args?\s*\(\s*\[?\s*[bB]?"(?:-c|\/c|\/C|-Command)"/;
+// An .arg()/.args() whose argument does NOT start with a string literal → dynamic.
+const DYNAMIC_ARG = /\.args?\s*\(\s*(?![bB]?["[])[A-Za-z_&*([]/;
+
+export async function scanTreeSitterRust(fp, raw) {
+  if (process.env.AGENTIC_SECURITY_TREE_SITTER !== '1') return [];
+  if (treeSitterLangOf(fp) !== 'rust') return [];
+  if (!raw || raw.length > 500_000) return [];
+  if (!/Command::new/.test(raw)) return [];           // cheap pre-filter
+
+  const parser = await getParserFor('rust');
+  if (!parser) return [];                              // optional dep absent → degrade
+  let tree;
+  try { tree = parser.parse(raw); } catch { return []; }
+
+  const findings = [];
+  const seen = new Set();
+  walkNamed(tree.rootNode, (n) => {
+    if (n.type !== 'call_expression') return;
+    const text = n.text;
+    if (!SHELL_PROG.test(text) || !SHELL_FLAG.test(text) || !DYNAMIC_ARG.test(text)) return;
+    const line = n.startPosition.row + 1;
+    if (seen.has(line)) return;
+    seen.add(line);
+    findings.push({
+      id: `ts-rust-cmdi:${fp}:${line}`,
+      severity: 'high', file: fp, line,
+      vuln: 'Command injection (Rust shell spawn with dynamic argument)',
+      cwe: 'CWE-78', family: 'command-injection', parser: 'TREE-SITTER', confidence: 0.55,
+      description: 'A std::process::Command spawns a shell (sh/bash/cmd/powershell) with -c/-Command and a non-literal argument. If that argument is attacker-influenced this is command injection.',
+      remediation: 'Do not pass input to a shell. Invoke the program directly — Command::new(prog).arg(userArg) without a shell — and validate inputs.',
+    });
+  });
+  return findings;
+}
+
+// Convenience: run every tree-sitter sink detector over a file-content map.
+export async function scanTreeSitterSinks(fileContents) {
+  if (process.env.AGENTIC_SECURITY_TREE_SITTER !== '1') return [];
+  const out = [];
+  for (const [fp, c] of Object.entries(fileContents || {})) {
+    if (typeof c !== 'string') continue;
+    try { out.push(...await scanTreeSitterRust(fp, c)); } catch { /* never fail the scan */ }
+  }
+  return out;
+}

package/src/sast/weak-password-hash.js

@@ -32,6 +32,34 @@ const PATTERNS = {
       { re: /\bsha1\.(?:Sum|New)\s*\(\s*(?:\[\]byte\s*\(\s*)?(\w+)/g, label: 'sha1.Sum/New' },
     ],
   },
+  ruby: {
+    ext: /\.rb$/i,
+    rules: [
+      { re: /\bDigest::(?:MD5|SHA1)\s*\.\s*(?:hexdigest|digest|base64digest)\s*\(\s*(\w+)/g, label: 'Digest::MD5/SHA1' },
+      { re: /\b(?:Digest::)?(?:MD5|SHA1)\.new[\s\S]{0,40}\.update\s*\(\s*(\w+)/g, label: 'Digest MD5/SHA1 new+update' },
+    ],
+  },
+  csharp: {
+    ext: /\.cs$/i,
+    rules: [
+      // MD5.Create()…ComputeHash(<var>) / MD5.HashData(<var>) — capture hashed var.
+      { re: /\b(?:MD5|SHA1)\s*\.\s*(?:Create\s*\(\s*\)\s*\.\s*ComputeHash|HashData)\s*\([\s\S]{0,120}?(\w+)\s*\)/g, label: 'MD5/SHA1 ComputeHash/HashData' },
+      { re: /\bnew\s+(?:MD5|SHA1)(?:CryptoServiceProvider|Managed)?\s*\(/g, label: 'MD5/SHA1 provider' },
+    ],
+  },
+  kotlin: {
+    ext: /\.kt$/i,
+    rules: [
+      { re: /\bMessageDigest\.getInstance\s*\(\s*"(?:MD5|SHA-?1)"\s*\)[\s\S]{0,80}?\.digest\s*\(\s*(\w+)/g, label: 'MessageDigest MD5/SHA-1' },
+    ],
+  },
+  php: {
+    ext: /\.(?:php|phtml)$/i,
+    rules: [
+      { re: /\b(?:md5|sha1)\s*\(\s*\$?(\w+)/g, label: 'md5()/sha1()' },
+      { re: /\bhash\s*\(\s*['"](?:md5|sha1)['"]\s*,\s*\$?(\w+)/g, label: 'hash("md5"/"sha1", …)' },
+    ],
+  },
 };
 
 export function scanWeakPasswordHash(fp, raw) {

package/src/sast/weak-randomness.js

@@ -9,8 +9,18 @@
 //   Go: rand.Intn(), rand.Int(), rand.Float64(), rand.Int31(), rand.Int63()
 //   Ruby: rand(), Random.rand, Random.new.rand
 //   PHP: rand(), mt_rand(), array_rand(), shuffle()
+//   Java: new Random(), Math.random(), ThreadLocalRandom.current().nextInt()
+//   Kotlin: Random.next*, kotlin.random.Random, java.util.Random
+//   C#: new Random()
 
 const SECURITY_CONTEXT = /\b(token|session|nonce|key|secret|password|otp|csrf|salt|code|pin|auth|reset|verify|captcha|challenge|ticket)\b/i;
+// camelCase carrier: a security term as the suffix of an identifier
+// (`newToken`, `genSecret`, `sessionId`) — `\bword\b` misses these. Case
+// sensitive so it only fires on the CamelCase boundary, not generic prose.
+const SECURITY_CONTEXT_CAMEL = /[a-z](?:Token|Secret|Nonce|Salt|Otp|Password|Passwd|ApiKey|SessionId|Csrf|Cookie|Jwt|Nonce)\b/;
+// snake_case carrier: same idea for `session_token`, `reset_token`,
+// `api_secret` — `\btoken\b` misses these because `_` is a word char.
+const SECURITY_CONTEXT_SNAKE = /_(?:token|secret|nonce|salt|otp|password|passwd|key|session|csrf|seed|cookie|jwt)\b/i;
 
 function _line(raw, idx) {
   return raw.slice(0, idx).split('\n').length;
@@ -47,6 +57,28 @@ const LANG_PATTERNS = {
       { re: /\b(?:rand|mt_rand|array_rand)\s*\(/g, label: 'rand() / mt_rand()' },
     ],
   },
+  java: {
+    ext: /\.java$/i,
+    patterns: [
+      { re: /\bnew\s+Random\s*\(/g, label: 'java.util.Random' },
+      { re: /\bMath\.random\s*\(\s*\)/g, label: 'Math.random()' },
+      { re: /\bThreadLocalRandom\.current\s*\(\s*\)\s*\.\s*next\w*\s*\(/g, label: 'ThreadLocalRandom (non-crypto)' },
+    ],
+  },
+  kotlin: {
+    ext: /\.kt$/i,
+    patterns: [
+      { re: /\bRandom\s*\(\s*\)\s*\.\s*next\w*\s*\(/g, label: 'Random() (non-crypto)' },
+      { re: /\bRandom\s*\.\s*(?:next\w+|Default)\b/g, label: 'kotlin.random.Random' },
+      { re: /\bnew\s+(?:java\.util\.)?Random\s*\(/g, label: 'java.util.Random' },
+    ],
+  },
+  csharp: {
+    ext: /\.cs$/i,
+    patterns: [
+      { re: /\bnew\s+Random\s*\(/g, label: 'System.Random' },
+    ],
+  },
 };
 
 export function scanWeakRandomness(fp, raw) {
@@ -67,10 +99,16 @@ export function scanWeakRandomness(fp, raw) {
       const lineStart = raw.lastIndexOf('\n', m.index) + 1;
       const lineEnd = raw.indexOf('\n', m.index);
       const lineText = raw.slice(lineStart, lineEnd > 0 ? lineEnd : raw.length);
-      if (!SECURITY_CONTEXT.test(lineText)) {
-        const prevLineStart = raw.lastIndexOf('\n', lineStart - 2) + 1;
-        const prevLine = raw.slice(prevLineStart, lineStart - 1);
-        if (!SECURITY_CONTEXT.test(prevLine)) continue;
+      if (!SECURITY_CONTEXT.test(lineText) && !SECURITY_CONTEXT_CAMEL.test(lineText) && !SECURITY_CONTEXT_SNAKE.test(lineText)) {
+        // Widen the lookback to the enclosing block: the security keyword is
+        // often on the function signature a few lines up (`function newToken()
+        // { … Math.random() … }`), not the line immediately before the call.
+        let winStart = lineStart;
+        for (let k = 0; k < 6 && winStart > 0; k++) {
+          winStart = raw.lastIndexOf('\n', winStart - 2) + 1;
+        }
+        const window = raw.slice(winStart, lineStart - 1);
+        if (!SECURITY_CONTEXT.test(window) && !SECURITY_CONTEXT_CAMEL.test(window) && !SECURITY_CONTEXT_SNAKE.test(window)) continue;
       }
       findings.push({
         id: `weak-rng:${fp}:${line}`,
@@ -79,7 +117,10 @@ export function scanWeakRandomness(fp, raw) {
         vuln: `Insecure Randomness — ${label} used for security-sensitive value`,
         severity: 'high',
         family: 'weak-rng',
-        cwe: 'CWE-330',
+        // CWE-338 (cryptographically weak PRNG) — more specific than the
+        // CWE-330 parent; every pattern here (Math.random / random.* / rand /
+        // math.rand) is a non-CSPRNG used in a security context.
+        cwe: 'CWE-338',
         parser: 'WEAK-RNG',
         confidence: 0.80,
         description: `${label} is not cryptographically secure. An attacker can predict the output and forge tokens, bypass OTP, or guess session identifiers.`,

package/src/sast/wrong-context-sanitizer.js

@@ -0,0 +1,149 @@
+// Wrong-context output encoding (roadmap #1, practical slice) — CWE-79.
+//
+// Context-aware sanitization is the single biggest XSS precision lever, but
+// the full model (context-tagged taint through the lattice) is a core-engine
+// change. This detector ships the most impactful, UNAMBIGUOUS case as a
+// standalone pattern rule:
+//
+//   An HTML-ENTITY encoder (escapeHtml / htmlspecialchars / he.encode /
+//   lodash.escape …) applied to a value that is then used as a URL
+//   (`.href` / `.src` / `location` / a JSX `href=`/`src=` attribute).
+//
+// HTML-entity encoding is the right tool for HTML *body/attribute text*. It
+// does NOT neutralize a dangerous URL SCHEME — `javascript:alert(1)` and
+// `data:text/html,…` survive entity-encoding unchanged, so the value is still
+// XSS-exploitable in a URL context. This is a textbook wrong-context bug and a
+// false sense of safety (the code looks sanitized).
+//
+// Deliberately high precision: only HTML-entity encoders (not generic names
+// like bare `escape`, not `encodeURIComponent`, which is a different — non-XSS
+// — mistake in URLs), and suppressed when a scheme/allow-list check is nearby.
+
+import { blankComments } from './_comment-strip.js';
+
+// Distinctive HTML-entity encoder callees. Intentionally excludes bare
+// `escape` (too generic) and `encodeURIComponent` (URL-encoding, not XSS).
+const HTML_ENCODER = "(?:escapeHtml|escapeHTML|htmlspecialchars|htmlentities|he\\.encode|he\\.escape|_\\.escape|lodash\\.escape)";
+
+const PATTERNS = [
+  // Assignment to a URL-bearing property: el.href = …escapeHtml(url)…
+  new RegExp("\\b(?:location(?:\\.href)?|[\\w$.]+\\.(?:href|src))\\s*=\\s*([^;\\n]*?\\b" + HTML_ENCODER + "\\s*\\([^;\\n]*)", "g"),
+  // JSX / template attribute: href={ escapeHtml(url) } / src="...${he.encode(u)}..."
+  new RegExp("\\b(?:href|src)\\s*=\\s*[{\"'`]?[^\"'`>;\\n]*?\\b" + HTML_ENCODER + "\\s*\\(", "g"),
+];
+
+// A nearby URL-scheme allow-list / validation makes the HTML-encoder a
+// belt-and-suspenders choice rather than the sole (wrong) defense → suppress.
+const SCHEME_GUARD = [
+  /\bstartsWith\s*\(\s*['"]https?:/i,
+  /\^https\?:/i,
+  /\bnew\s+URL\s*\(/,
+  /\ballow(?:ed|list)?\s*(?:schemes?|protocols?|hosts?)/i,
+  /\bprotocol\s*===?\s*['"]https?:/i,
+  /\bsanitizeUrl\b|\bisSafeUrl\b|\bvalidateUrl\b/i,
+];
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+function isJsLike(fp) { return /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp); }
+function isPhp(fp) { return /\.php$/i.test(fp); }
+
+// R5 (PRD §5) — context-aware sanitizer ADEQUACY. The model: a sanitizer
+// neutralizes a specific context; using it before a sink of a DIFFERENT context
+// is a no-op that looks safe. The highest-signal mismatches beyond the URL case
+// above: an HTML-entity encoder applied to a value that then reaches a SHELL or
+// SQL sink — HTML-escaping does nothing for command/SQL injection.
+const _SHELL_SINK = /\b(?:exec|execSync|execFile|execFileSync|spawn|spawnSync|system|popen|shell_exec|child_process\.\w+)\s*\(/;
+const _SQL_SINK = /\.(?:query|execute|raw|exec)\s*\(|\bdb\.raw\s*\(|sequelize\.query\s*\(/i;
+const _HTML_ENC_CALL = new RegExp(HTML_ENCODER + "\\s*\\(", "g");
+
+export function scanSanitizerContextMismatch(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  if (!isJsLike(fp) && !isPhp(fp) && !/\.py$/i.test(fp)) return [];
+  if (!/escapeHtml|escapeHTML|htmlspecialchars|htmlentities|he\.encode|he\.escape|_\.escape|lodash\.escape/i.test(raw)) return [];
+  if (!_SHELL_SINK.test(raw) && !_SQL_SINK.test(raw)) return [];
+  const code = blankComments(raw);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+  // Track vars assigned directly from an HTML encoder (one hop).
+  const htmlVars = new Set();
+  const VAR_ASSIGN = new RegExp("(?:\\b(?:const|let|var)\\s+)?([A-Za-z_$][\\w$]*)\\s*=\\s*" + HTML_ENCODER + "\\s*\\(", "g");
+  let m;
+  while ((m = VAR_ASSIGN.exec(code))) htmlVars.add(m[1]);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const isShell = _SHELL_SINK.test(line);
+    const isSql = !isShell && _SQL_SINK.test(line);
+    if (!isShell && !isSql) continue;
+    const argRegion = line.slice(line.search(isShell ? _SHELL_SINK : _SQL_SINK));
+    _HTML_ENC_CALL.lastIndex = 0;
+    const inline = _HTML_ENC_CALL.test(argRegion);
+    const viaVar = !inline && [...htmlVars].some((v) => new RegExp(`\\b${v}\\b`).test(argRegion));
+    if (!inline && !viaVar) continue;
+    if (seen.has(i + 1)) continue;
+    seen.add(i + 1);
+    const ctx = isShell ? { cwe: 'CWE-78', kind: 'command', vuln: 'Command Injection' }
+      : { cwe: 'CWE-89', kind: 'SQL', vuln: 'SQL Injection' };
+    findings.push({
+      id: `wrong-context-sanitizer:sink:${fp}:${i + 1}`,
+      severity: 'high',
+      file: fp,
+      line: i + 1,
+      vuln: `Wrong-context sanitizer (HTML-encoded value used in a ${ctx.kind} sink)`,
+      cwe: ctx.cwe,
+      family: ctx.kind === 'command' ? 'command-injection' : 'sql-injection',
+      parser: 'SAST',
+      description: `An HTML-entity encoder was applied to a value that then flows into a ${ctx.kind} sink. HTML escaping neutralizes HTML markup, NOT ${ctx.kind} metacharacters — the value is still ${ctx.vuln}-exploitable while appearing sanitized.`,
+      remediation: ctx.kind === 'command'
+        ? 'Use an argv-form API (execFile/spawn with an args array), never a shell string; HTML escaping is irrelevant here.'
+        : 'Use parameterized queries / prepared statements; HTML escaping does not prevent SQL injection.',
+    });
+  }
+  return findings;
+}
+
+export function scanWrongContextSanitizer(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  if (!isJsLike(fp) && !isPhp(fp)) return [];
+  // Cheap pre-filter: must contain both an HTML encoder and a URL sink token.
+  if (!/escapeHtml|htmlspecialchars|htmlentities|he\.|_\.escape|lodash\.escape/i.test(raw)) return [];
+  if (!/\b(?:href|src)\b|location/i.test(raw)) return [];
+
+  const code = blankComments(raw, isPhp(fp) ? undefined : undefined);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  for (const re of PATTERNS) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(code))) {
+      const line = lineOf(code, m.index);
+      if (seen.has(line)) continue;
+      // Suppress when a scheme guard appears within 5 lines above.
+      const lo = Math.max(0, line - 6);
+      const near = lines.slice(lo, line).join('\n');
+      if (SCHEME_GUARD.some(g => g.test(near))) continue;
+      seen.add(line);
+      findings.push({
+        id: `wrong-context-sanitizer:${fp}:${line}`,
+        severity: 'medium',
+        file: fp,
+        line,
+        vuln: 'Wrong-context output encoding (HTML-encoded value used as a URL)',
+        cwe: 'CWE-79',
+        family: 'xss',
+        parser: 'SAST',
+        description:
+          'An HTML-entity encoder is applied to a value used in a URL context (href/src/location). ' +
+          'HTML-entity encoding does not neutralize dangerous URL schemes such as `javascript:` or ' +
+          '`data:`, so the value remains XSS-exploitable — while looking sanitized.',
+        remediation:
+          'Validate the URL scheme against an allow-list (e.g. only http/https) or build the URL with ' +
+          'the URL API; reserve HTML-entity encoding for HTML body/attribute text, not URLs.',
+      });
+    }
+  }
+  return findings;
+}

package/src/sast/xpath-injection.js

@@ -3,14 +3,32 @@ import { blankComments } from './_comment-strip.js';
 //
 // Same shape as LDAP injection — string concatenation into a query language
 // that has its own operators. We catch concatenation patterns into:
-//   - javax.xml.xpath / org.jaxen / org.dom4j  (Java)
+//   - javax.xml.xpath / org.jaxen / org.dom4j  (Java, Kotlin)
 //   - lxml.etree / xml.etree                   (Python)
 //   - xpath npm pkg                            (Node)
+//   - DOMXPath::query / ::evaluate             (PHP)
+//   - XPathNavigator.Select / SelectNodes      (C#)
+//   - Nokogiri xpath / REXML::XPath            (Ruby)
+//   - xmlpath / htmlquery / antchfx xpath      (Go)
+
+// A string literal whose body may contain the OTHER quote char — an XPath
+// expression like `"//user[@name='" + x` embeds a single quote, which a naive
+// `[^"']*` body would stop at. Match each quote style with its own body.
+const STR = String.raw`(?:"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*')`;
 
 const PATTERNS = {
-  java: /\.\s*(?:compile|evaluate)\s*\(\s*"[^"]*"\s*\+\s*\w+/g,
-  py:   /\.\s*(?:xpath|find|findall)\s*\(\s*["'][^"']*["']\s*[%+]\s*\w+|\.\s*xpath\s*\(\s*f["']/g,
-  js:   /\b(?:xpath|select)\s*\(\s*[`"][^`"]*[`"]\s*\+\s*\w+|\bxpath\.select\s*\(\s*`[^`]*\$\{/g,
+  java: new RegExp(String.raw`\.\s*(?:compile|evaluate)\s*\(\s*${STR}\s*\+\s*\w+`, 'g'),
+  kt:   new RegExp(String.raw`\.\s*(?:compile|evaluate)\s*\(\s*${STR}\s*\+\s*\w+|\.\s*(?:compile|evaluate)\s*\(\s*"[^"\n]*\$\{`, 'g'),
+  py:   new RegExp(String.raw`\.\s*(?:xpath|find|findall)\s*\(\s*${STR}\s*[%+]\s*\w+|\.\s*xpath\s*\(\s*[fF]["']`, 'g'),
+  js:   new RegExp(String.raw`\b(?:xpath|select)\s*\(\s*(?:` + '`' + String.raw`[^` + '`' + String.raw`]*` + '`' + String.raw`|${STR})\s*\+\s*\w+|\bxpath\.select\s*\(\s*` + '`' + String.raw`[^` + '`' + String.raw`]*\$\{`, 'g'),
+  // PHP DOMXPath: $xpath->query("…" . $u) / ->evaluate("…" . $u)
+  php:  new RegExp(String.raw`->\s*(?:query|evaluate)\s*\(\s*${STR}\s*\.\s*\$\w+`, 'g'),
+  // C#: nav.Select / doc.SelectNodes / SelectSingleNode / XPathSelectElements with concat
+  cs:   new RegExp(String.raw`\.\s*(?:Select|SelectNodes|SelectSingleNode|XPathSelectElement|XPathSelectElements|Compile)\s*\(\s*\$?${STR}\s*\+\s*\w+|\.\s*(?:Select|SelectNodes|SelectSingleNode)\s*\(\s*\$"[^"\n]*\{`, 'g'),
+  // Ruby Nokogiri / REXML: .xpath("…#{u}") / .at_xpath / XPath.match with #{} or concat
+  rb:   new RegExp(String.raw`\.\s*(?:xpath|at_xpath|search)\s*\(\s*(?:"[^"\n]*#\{|'[^'\n]*#\{)|\.\s*(?:xpath|at_xpath)\s*\(\s*${STR}\s*\+\s*\w+|XPath\s*\.\s*(?:match|first|each)\s*\([^,]+,\s*(?:"[^"\n]*#\{|'[^'\n]*#\{)`, 'g'),
+  // Go xmlpath/htmlquery/antchfx: xmlpath.Compile("…"+u) / htmlquery.Find(doc, "…"+u)
+  go:   new RegExp(String.raw`\b(?:xmlpath\.Compile|htmlquery\.(?:Find|FindOne|QueryAll|Query)|xpath\.Compile|navigator\.Compile)\s*\([^)]*${STR}\s*\+\s*\w+`, 'g'),
 };
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -20,11 +38,17 @@ export function scanXPathInjection(fp, raw) {
   let lang;
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) lang = 'js';
   else if (/\.java$/i.test(fp)) lang = 'java';
+  else if (/\.kt$/i.test(fp)) lang = 'kt';
   else if (/\.py$/i.test(fp)) lang = 'py';
+  else if (/\.(?:php|phtml)$/i.test(fp)) lang = 'php';
+  else if (/\.cs$/i.test(fp)) lang = 'cs';
+  else if (/\.rb$/i.test(fp)) lang = 'rb';
+  else if (/\.go$/i.test(fp)) lang = 'go';
   else return [];
 
-  const code = blankComments(raw, lang === 'py' ? 'py' : undefined);
-  if (!/\bxpath|XPath|\.xpath\(/i.test(code)) return [];
+  const code = blankComments(raw, (lang === 'py' || lang === 'rb') ? 'py' : undefined);
+  // Relevance gate: an XPath-ish API or an XPath expression literal must appear.
+  if (!/\bxpath|XPath|\.xpath\(|DOMXPath|SelectNodes|SelectSingleNode|XPathNavigator|xmlpath|htmlquery|REXML|\/\/\w/i.test(code)) return [];
   const re = new RegExp(PATTERNS[lang].source, PATTERNS[lang].flags);
   const findings = [];
   const seen = new Set();

package/src/sast/xss-reflected-multilang.js

@@ -0,0 +1,116 @@
+// Cross-language reflected-XSS structural detector — PRD Tier 1 (recall).
+//
+// JS/Python reflected XSS is handled by the flow engine + framework structural
+// detectors; the second-tier languages had no XSS coverage. This module adds a
+// taint-independent structural rule per language: user input written into an
+// HTML response via concatenation / interpolation, without an output encoder.
+//
+// Precision: each language carries its own escaper exclusion (htmlspecialchars,
+// HtmlEncode, html_escape, template.HTMLEscapeString, …). When an escaper is
+// applied on the sink line the finding is suppressed — the parameterized/encoded
+// form must NOT match. HTML context is required (an HTML tag literal, an HTML
+// content-type, or a raw-superglobal echo) so plain-text responses don't fire.
+
+import { blankComments } from './_comment-strip.js';
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+const REMEDIATION =
+  'HTML-encode user input before writing it into a response: htmlspecialchars (PHP), ' +
+  'template/html.EscapeString (Go), ERB::Util.html_escape / avoid .html_safe (Ruby), ' +
+  'HttpUtility.HtmlEncode (C#), or an auto-escaping template engine. Never concatenate ' +
+  'request data straight into an HTML response.';
+
+// Per-language: { ext, sinks:[RegExp], escaper:RegExp }. A line matches when a
+// sink RegExp matches and the escaper RegExp does NOT.
+const LANGS = {
+  go: {
+    ext: /\.go$/i,
+    // fmt.Fprint*/io.WriteString to the ResponseWriter, or w.Write([]byte(...)),
+    // building an HTML string ("<…") by concatenation.
+    sinks: [
+      /\b(?:fmt\.Fprintf?|fmt\.Fprintln|io\.WriteString)\s*\(\s*w\b[^)\n]*"<[^"\n]*"\s*\+/,
+      /\bw\.Write\s*\(\s*\[\]byte\s*\(\s*"<[^"\n]*"\s*\+/,
+    ],
+    escaper: /\b(?:template\.HTMLEscapeString|html\.EscapeString|template\.HTMLEscaper)\s*\(/,
+  },
+  php: {
+    ext: /\.(?:php|phtml)$/i,
+    // echo/print of a request superglobal (directly or concatenated).
+    sinks: [
+      /\b(?:echo|print)\b[^;\n]*\$_(?:GET|POST|REQUEST|COOKIE)\b/,
+      /\bprintf\s*\([^;\n]*\$_(?:GET|POST|REQUEST|COOKIE)\b/,
+    ],
+    escaper: /\b(?:htmlspecialchars|htmlentities|strip_tags|filter_var|urlencode|rawurlencode|json_encode|intval|floatval|htmlspecialchars_decode)\s*\(/,
+  },
+  ruby: {
+    ext: /\.rb$/i,
+    // render inline:/html: with #{} interpolation, raw(params…), params….html_safe
+    sinks: [
+      /\brender\s+(?:inline|html):\s*["'][^"'\n]*#\{/,
+      /\braw\s*\(\s*(?:params|request|@\w+\.params)\b/,
+      /\b(?:params|request)\b[^\n]*\.\s*html_safe\b/,
+    ],
+    escaper: /\b(?:ERB::Util\.html_escape|CGI\.escapeHTML|h\s*\(|sanitize\s*\()/,
+  },
+  csharp: {
+    ext: /\.cs$/i,
+    // Response.Write of Request data, or an HTML string concatenation.
+    sinks: [
+      /\bResponse\.Write\s*\([^)\n]*\bRequest\b/,
+      /\bResponse\.Write\s*\(\s*"<[^"\n]*"\s*\+/,
+    ],
+    escaper: /\b(?:HttpUtility\.HtmlEncode|HtmlEncoder\.|Server\.HtmlEncode|WebUtility\.HtmlEncode|AntiXss\.)/,
+  },
+  kotlin: {
+    ext: /\.kt$/i,
+    // Ktor respondText building HTML by interpolation/concat.
+    sinks: [
+      /\brespondText\s*\(\s*"<[^"\n]*\$/,
+      /\brespondText\s*\(\s*"<[^"\n]*"\s*\+/,
+      /\brespondText\s*\(\s*"[^"\n]*\$[^"\n]*"\s*,\s*ContentType\.Text\.Html/,
+    ],
+    escaper: /\b(?:htmlEscape|escapeHtml|HtmlUtils\.htmlEscape|encodeHTML)\s*\(/,
+  },
+  java: {
+    ext: /\.java$/i,
+    // Servlet: response.getWriter().write/print/println(...) or a PrintWriter
+    // `out`, building an HTML string ("<…") by concatenation. The concat (`"<…"
+    // +`) is the reflected-XSS shape — a static literal has no `+`.
+    sinks: [
+      /\.\s*(?:getWriter\s*\(\s*\)\s*\.\s*)?(?:write|print|println|append|format|printf)\s*\(\s*"<[^"\n]*"\s*\+/,
+      /\b(?:out|writer|pw|w)\s*\.\s*(?:write|print|println|append)\s*\(\s*"<[^"\n]*"\s*\+/,
+    ],
+    escaper: /\b(?:encodeForHTML|forHtml|forHtmlContent|htmlEscape|escapeHtml4?|StringEscapeUtils|HtmlUtils\.htmlEscape|Encode\.forHtml|ESAPI|OWASP)\b/,
+  },
+};
+
+export function scanXssReflectedMultilang(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  let lang = null;
+  for (const v of Object.values(LANGS)) { if (v.ext.test(fp)) { lang = v; break; } }
+  if (!lang) return [];
+
+  const code = blankComments(raw, /\.(?:rb|php)$/i.test(fp) ? 'py' : undefined);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (lang.escaper.test(line)) continue;
+    if (!lang.sinks.some((re) => re.test(line))) continue;
+    const ln = i + 1;
+    const id = `xss-reflected:${fp}:${ln}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line: ln,
+      vuln: 'Reflected XSS — user input written into an HTML response without output encoding',
+      severity: 'high', cwe: 'CWE-79', family: 'xss', parser: 'XSS-ML', confidence: 0.62,
+      snippet: (raw.split('\n')[ln - 1] || '').trim().slice(0, 200),
+      remediation: REMEDIATION,
+    });
+  }
+  return findings;
+}

package/src/sast/xxe.js

@@ -64,6 +64,28 @@ const PYTHON_DEFUSED_RE = /(?:^|\n)\s*(?:from\s+defusedxml\b|import\s+defusedxml
 // upstream-recommended safe shape.
 const PYTHON_LXML_SAFE_RE = /XMLParser\s*\([^)]*\bresolve_entities\s*=\s*False\b[^)]*\)/;
 
+// ── PHP / Go / Ruby ─────────────────────────────────────────────────────────
+// Each of these XML stacks is XXE-SAFE BY DEFAULT in current versions; the
+// vulnerability appears only when the caller explicitly opts INTO external-
+// entity / DTD-loading behavior. So we flag the opt-in flags, not the parse
+// call itself — the plain parse is correctly clean.
+//
+// PHP:   loadXML / simplexml_load_string|file with LIBXML_NOENT, LIBXML_DTDLOAD,
+//        or LIBXML_DTDVALID. (PHP >= 8.0 disables entity substitution by
+//        default; these flags re-enable it.)
+const PHP_XXE_RE =
+  /\b(?:loadXML|simplexml_load_string|simplexml_load_file)\s*\([^;]*\bLIBXML_(?:NOENT|DTDLOAD|DTDVALID)\b/g;
+// Go:   encoding/xml Decoder made unsafe by `Strict = false` or a custom
+//       `Entity` map that defines expansions. Gated on an xml-decoder hint.
+const GO_XXE_RE =
+  /\b\w+\s*\.\s*(?:Strict\s*=\s*false|Entity\s*=\s*(?:map\[string\]string|xml\.HTMLEntity))/g;
+const GO_XML_HINT_RE = /\b(?:encoding\/xml|xml\.NewDecoder|xml\.Decoder)\b/;
+// Ruby: Nokogiri parse whose options enable NOENT / DTDLOAD / replace_entities.
+//       Default Nokogiri::XML(xml) is safe. Gated on a Nokogiri/LibXML hint.
+const RUBY_XXE_RE =
+  /\.\s*(?:noent|dtdload|dtdvalid|replace_entities)\b/g;
+const RUBY_XML_HINT_RE = /\bNokogiri\s*::\s*XML\b|\bLibXML\b|\bXML::Parser\b/;
+
 import { blankComments } from './_comment-strip.js';
 
 function _stripLineComment(s, lang) {
@@ -136,5 +158,50 @@ export function scanXXE(fp, raw) {
     return findings;
   }
 
+  // ── PHP / Go / Ruby: flag the explicit opt-in to external entities ──────────
+  const _emitOptIn = (code, re, gate, mkVuln, mkRem) => {
+    if (gate && !gate.test(code)) return;
+    const r = new RegExp(re.source, re.flags);
+    let m;
+    const seen = new Set();
+    while ((m = r.exec(code))) {
+      const line = _lineOf(raw, m.index);
+      if (seen.has(line)) continue;
+      seen.add(line);
+      findings.push({
+        id: `xxe:${fp}:${line}`,
+        file: fp, line,
+        vuln: mkVuln(), severity: 'high', cwe: 'CWE-611',
+        stride: 'Information Disclosure',
+        snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+        remediation: mkRem(), confidence: 0.8, parser: 'XXE',
+      });
+    }
+  };
+
+  if (/\.(?:php|phtml)$/i.test(fp)) {
+    const code = blankComments(raw, 'py');
+    _emitOptIn(code, PHP_XXE_RE, null,
+      () => 'XXE: XML parsed with LIBXML_NOENT / LIBXML_DTDLOAD (external entities enabled)',
+      () => 'Drop the LIBXML_NOENT / LIBXML_DTDLOAD flags — PHP >= 8.0 disables entity substitution by default, so plain loadXML($xml) / simplexml_load_string($xml) is safe. If you must accept DTDs, set libxml_set_external_entity_loader to reject network/file access.');
+    return findings;
+  }
+
+  if (/\.go$/i.test(fp)) {
+    const code = blankComments(raw);
+    _emitOptIn(code, GO_XXE_RE, GO_XML_HINT_RE,
+      () => 'XXE: encoding/xml Decoder configured with Strict=false or a custom Entity map',
+      () => 'Go\'s encoding/xml ignores external entities by default — do not set Strict=false or populate Decoder.Entity with untrusted input. Leave the decoder at its defaults.');
+    return findings;
+  }
+
+  if (/\.rb$/i.test(fp)) {
+    const code = blankComments(raw, 'py');
+    _emitOptIn(code, RUBY_XXE_RE, RUBY_XML_HINT_RE,
+      () => 'XXE: Nokogiri parse options enable external entities (NOENT / DTDLOAD / replace_entities)',
+      () => 'Remove noent/dtdload/replace_entities — Nokogiri::XML(xml) is safe by default (entities are not expanded, DTDs are not loaded). Never enable these on untrusted XML.');
+    return findings;
+  }
+
   return [];
 }

package/src/sca/image-packages.js

@@ -0,0 +1,74 @@
+// R8 (PRD §5) — container-image OS-package inventory.
+//
+// container.js reads the Dockerfile (FROM + apt/apk install lines). This reads
+// the ACTUAL installed-package databases from an extracted image filesystem
+// (or the host), catching packages baked into the base image that the
+// Dockerfile never names. Components flow into the existing OSV pipeline + SBOM.
+//
+// Pure parsers (unit-tested) + a path-matching extractor. No daemon; reads the
+// package-DB files that appear when an image layer/tarball is unpacked.
+
+// Debian/Ubuntu: /var/lib/dpkg/status — RFC822-style blocks separated by blank
+// lines. Only "install ok installed" entries count (not removed/config-files).
+export function parseDpkgStatus(text) {
+  const out = [];
+  for (const block of String(text || '').split(/\n\s*\n/)) {
+    const name = (block.match(/^Package:\s*(.+)$/m) || [])[1];
+    const version = (block.match(/^Version:\s*(.+)$/m) || [])[1];
+    const status = (block.match(/^Status:\s*(.+)$/m) || [])[1] || '';
+    if (!name || !version) continue;
+    if (!/\binstalled\b/.test(status)) continue;
+    out.push({ name: name.trim(), version: version.trim(), ecosystem: 'Debian' });
+  }
+  return out;
+}
+
+// Alpine: /lib/apk/db/installed — blocks separated by blank lines; P:=name V:=version.
+export function parseApkInstalled(text) {
+  const out = [];
+  for (const block of String(text || '').split(/\n\s*\n/)) {
+    const name = (block.match(/^P:(.+)$/m) || [])[1];
+    const version = (block.match(/^V:(.+)$/m) || [])[1];
+    if (!name || !version) continue;
+    out.push({ name: name.trim(), version: version.trim(), ecosystem: 'Alpine' });
+  }
+  return out;
+}
+
+const _PURL = { Debian: (n, v) => `pkg:deb/debian/${n}@${v}`, Alpine: (n, v) => `pkg:apk/alpine/${n}@${v}` };
+
+// File-path tells for an unpacked image. Match on path suffix so it works
+// whether the scan root is the rootfs or a subdirectory of it.
+function _dbKind(path) {
+  const p = path.replace(/\\/g, '/');
+  if (/(?:^|\/)var\/lib\/dpkg\/status$/.test(p)) return 'dpkg';
+  if (/(?:^|\/)lib\/apk\/db\/installed$/.test(p)) return 'apk';
+  return null;
+}
+
+/**
+ * Extract OS-package components from any image package-DBs present in the scanned
+ * files. Returns components in the engine's component shape so they ride the
+ * existing OSV/SBOM pipeline. De-dups by ecosystem:name:version.
+ */
+export function extractImagePackages(fileContents) {
+  const comps = [];
+  const seen = new Set();
+  for (const [file, content] of Object.entries(fileContents || {})) {
+    const kind = _dbKind(file);
+    if (!kind) continue;
+    const pkgs = kind === 'dpkg' ? parseDpkgStatus(content) : parseApkInstalled(content);
+    for (const p of pkgs) {
+      const key = `${p.ecosystem}:${p.name}:${p.version}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      comps.push({
+        name: p.name, version: p.version, group: '', ecosystem: p.ecosystem,
+        purl: (_PURL[p.ecosystem] || (() => null))(p.name, p.version),
+        filePath: file, isUnpinned: false, isTransitive: false, isOsPackage: true,
+        scope: 'required', reachable: true,
+      });
+    }
+  }
+  return comps;
+}