@clear-capabilities/agentic-security-scanner 0.86.0 → 0.119.1

package/src/sast/crypto-protocol.js

@@ -54,7 +54,7 @@ function _shape(file, line, ruleId, vuln, fam, sev, cwe, remediation, descriptio
   };
 }
 
-const _RELEVANCE = /\bTLS\b|\bSSL\b|\btls\b|tls_version|tls_minimum|min[_-]?version|min[_-]?protocol|verify|ciph(?:er|ersuite)|NODE_TLS|InsecureSkipVerify|rejectUnauthor|trust[_-]?all|allow[_-]?all|jwt\.|jsonwebtoken|jose|PyJWT|jwt\b|MD5|SHA1|sha-?1\b|md5\b|DES\b|3DES|RC4|Blowfish|ECB|pbkdf2|PBKDF2|bcrypt|scrypt|argon2|Math\.random|random\.random|java\.util\.Random|new Random/i;
+const _RELEVANCE = /\bTLS\b|\bSSL\b|\btls\b|tls_version|tls_minimum|min[_-]?version|min[_-]?protocol|verify|ciph(?:er|ersuite)|NODE_TLS|InsecureSkipVerify|rejectUnauthor|trust[_-]?all|allow[_-]?all|jwt\.|jsonwebtoken|jose|PyJWT|jwt\b|MD5|SHA1|sha-?1\b|md5\b|DES\b|3DES|RC4|Blowfish|ECB|pbkdf2|PBKDF2|bcrypt|scrypt|argon2|Math\.random|random\.random|java\.util\.Random|new Random|IvParameterSpec|GCMParameterSpec|openssl_encrypt|createCipher|\bAES\b|\baes\b|\.iv\s*=|\bIV\b/i;
 
 function _isCryptoRelevant(text) { return _RELEVANCE.test(text); }
 
@@ -148,6 +148,15 @@ function detectWeakCiphers(file, raw, code, out, seen) {
     { re: /\bciphers\s*:\s*['"`][^'"`]*(?:NULL|RC4|EXPORT|aNULL|eNULL|3DES|DES-CBC)/g },
     // Go cipher.NewTripleDESCipher
     { re: /\bcipher\.New(?:TripleDESCipher|DESCipher)\b/g },
+    // Go crypto/des + crypto/rc4 package constructors
+    { re: /\b(?:des\.New(?:TripleDESCipher|Cipher)|rc4\.NewCipher)\s*\(/g },
+    // PHP openssl_encrypt/openssl_decrypt with a weak algorithm string.
+    { re: /\bopenssl_(?:encrypt|decrypt)\s*\([^;)]*,\s*["'](?:des|des-ede3?|3des|rc4|rc2|bf|blowfish|cast5|seed)\b[^"']*["']/gi },
+    // PHP legacy mcrypt with DES/3DES/RC4/Blowfish.
+    { re: /\bmcrypt_(?:encrypt|decrypt|module_open)\s*\(\s*(?:MCRYPT_(?:DES|3DES|TRIPLEDES|ARCFOUR|RC2|RC4|BLOWFISH|CAST_128)|["'](?:des|tripledes|arcfour|rc2|rc4|blowfish)["'])/gi },
+    // Ruby OpenSSL::Cipher.new("DES-…"/"RC4"/"bf-…") or OpenSSL::Cipher::DES.new
+    { re: /\bOpenSSL::Cipher\.new\s*\(\s*["'](?:des|des-ede3?|3des|rc4|rc2|bf|blowfish|cast5|seed)\b[^"']*["']/gi },
+    { re: /\bOpenSSL::Cipher::(?:DES|RC4|RC2|Blowfish|CAST5)\b/g },
   ];
   for (const p of patterns) {
     let m;
@@ -196,8 +205,41 @@ function detectStaticIv(file, raw, code, out, seen) {
     { re: /\bcreateCipheriv\s*\([^,]+,\s*[^,]+,\s*['"`](?:0+|\\0+)['"`]/g },
     { re: /\bAES\.new\s*\([^,]+,[^,]+,\s*IV\s*=\s*b?['"](?:\\x00){8,}/g },
     { re: /\bcipher\.NewCBCEncrypter\s*\([^,]+,\s*make\s*\(\s*\[\]byte\s*,/g },  // make([]byte, blocksize)
+    // pyca/cryptography: a zero / repeated-byte literal IV — `iv = b'\x00' * 16`
+    // or `iv = b'\x00\x00…'` — fed to modes.CBC/CTR/CFB/OFB.
+    { re: /\biv\s*=\s*b['"](?:\\x00|\\0|0)+['"]\s*\*\s*\d+/gi },
+    { re: /\biv\s*=\s*b['"](?:\\x00|\\0){8,}['"]/gi },
+    { re: /\bmodes\.(?:CBC|CTR|CFB|OFB|GCM)\s*\(\s*b['"]/g },  // modes.CBC(b'…') literal IV/nonce
+    // Java/Kotlin: IvParameterSpec / GCMParameterSpec built from a freshly
+    // zero-initialized array (`new byte[16]` / `ByteArray(16)`) — no CSPRNG.
+    { re: /\b(?:Iv|GCM)ParameterSpec\s*\(\s*new\s+byte\s*\[\s*\d+\s*\]/g },          // Java
+    { re: /\b(?:Iv|GCM)ParameterSpec\s*\(\s*ByteArray\s*\(\s*\d+\s*\)/g },           // Kotlin
+    // Go: an IV/nonce that is `iv := make([]byte, …)` (all-zero, never filled
+    // from a CSPRNG) used with a stream/block-mode constructor. The `make`
+    // assignment usually precedes the NewXxx call, so gate on both being
+    // present in the file (NewXxx hint) and flag the make line.
+    { re: /\b\w*iv\w*\s*:?=\s*make\s*\(\s*\[\]byte\s*,/gi,
+      goGate: /\bcipher\.New(?:CBCEncrypter|CBCDecrypter|CTR|CFBEncrypter|CFBDecrypter|OFB)\b/,
+      // Safe if the file fills the IV from a CSPRNG — rand.Read(iv) /
+      // io.ReadFull(rand.Reader, iv) / crypto/rand usage.
+      goSafe: /\brand\.Read\s*\(|\bio\.ReadFull\s*\(\s*rand\.Reader|\bcrypto\/rand\b/ },
+    // C#: a zero/static IV assigned to .IV or passed to CreateEncryptor/Decryptor.
+    { re: /\.\s*IV\s*=\s*new\s+byte\s*\[\s*\d+\s*\]/g },                              // C# aes.IV = new byte[16]
+    { re: /\bCreateEncryptor\s*\(\s*[^,]+,\s*new\s+byte\s*\[\s*\d+\s*\]/g },          // C# CreateEncryptor(key, new byte[16])
+    // PHP: openssl_encrypt with an empty-string IV or a str_repeat("\0",N) IV.
+    { re: /\bopenssl_encrypt\s*\([^;]*,\s*(?:""|''|str_repeat\s*\(\s*["']\\?0["']\s*,)/g },
+    { re: /\$iv\s*=\s*str_repeat\s*\(\s*["']\\?0["']\s*,\s*\d+\s*\)/g },
+    // Ruby: cipher.iv = a zero / fixed literal string.
+    { re: /\.\s*iv\s*=\s*["']\\x?0(?:\\x?0|0)*["']\s*\*\s*\d+/gi },                    // cipher.iv = "\x00" * 16
+    { re: /\.\s*iv\s*=\s*["'](?:\\x00){4,}["']/gi },                                  // cipher.iv = "\x00\x00…"
+    { re: /\.\s*iv\s*=\s*["'][0]{8,}["']/g },                                         // cipher.iv = "0000…"
   ];
   for (const p of patterns) {
+    // Some patterns only make sense in the presence of a companion construct
+    // (e.g. a Go `iv := make([]byte,…)` is only suspicious when a CBC/CTR/…
+    // mode constructor uses it). Skip the pattern when its gate is absent.
+    if (p.goGate && !p.goGate.test(code)) continue;
+    if (p.goSafe && p.goSafe.test(code)) continue;
     let m;
     while ((m = p.re.exec(code))) {
       const ln = _line(raw, m.index);

package/src/sast/csharp-structural.js

@@ -0,0 +1,65 @@
+// C# structural detectors — PRD Tier 1.
+//
+// The main csharp.js is flow/taint-based and misses two corpus shapes:
+//   - a hardcoded secret in a const/static field, SPLIT across concatenated
+//     literals ("sk_" + "live_…") specifically to evade secret regexes;
+//   - SSRF via WebClient/HttpClient on a non-validated URL.
+// Both are regex/structural and complement the flow engine.
+
+import { blankComments } from './_comment-strip.js';
+
+const SECRET_PREFIX = /\b(?:sk_|sk-|AKIA|ghp_|gho_|xox[abps]-|AIza|eyJ|-----BEGIN|glpat-)/;
+// A field whose name signals a credential, assigned a string (or concat of
+// string literals — the splitting trick).
+const SECRET_FIELD = /\b\w*(?:apikey|api_key|secret|token|password|passwd|pwd|credential|privatekey|connectionstring|accesskey)\w*\s*=\s*((?:"[^"]*"\s*\+\s*)*"[^"]*")/ig;
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+// Join the contents of a concatenation of string literals.
+function joinLiterals(expr) {
+  const parts = expr.match(/"([^"]*)"/g) || [];
+  return parts.map(p => p.slice(1, -1)).join('');
+}
+
+export function scanCsharpStructural(fp, raw) {
+  if (!/\.cs$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const findings = [];
+  const seen = new Set();
+  const push = (f) => { if (!seen.has(f.id)) { seen.add(f.id); findings.push(f); } };
+
+  // Hardcoded secret in a credential-named field. The joined literal value must
+  // look like a real secret (length or known prefix) so header-name constants
+  // (ApiKeyHeader = "X-Api-Key") are not flagged.
+  let m;
+  const sre = new RegExp(SECRET_FIELD.source, SECRET_FIELD.flags);
+  while ((m = sre.exec(code))) {
+    const value = joinLiterals(m[1]);
+    if (value.length < 16 && !SECRET_PREFIX.test(value)) continue;
+    const line = lineOf(code, m.index);
+    push({
+      id: `csharp-hardcoded-secret:${fp}:${line}`, file: fp, line,
+      vuln: 'Hardcoded credential in a const/static field (C#)',
+      severity: 'high', cwe: 'CWE-798', family: 'secret', parser: 'CSHARP', confidence: 0.7,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Load the secret from the environment / a secrets manager (Environment.GetEnvironmentVariable, Azure Key Vault). Concatenating the literal to split it does not help — rotate the exposed value.',
+    });
+  }
+
+  // SSRF: WebClient/HttpClient fetch from a non-literal URL, unless a host
+  // allow/deny guard is present.
+  const SSRF_SINK = /\.(?:DownloadString|DownloadData|OpenRead|GetAsync|GetStringAsync|GetStreamAsync|GetByteArrayAsync)\s*\(\s*[A-Za-z_]\w*\s*\)/;
+  const SSRF_GUARD = /169\.254\.169\.254|\.Host\b|allow(?:ed)?Hosts?|IsLoopback|deny(?:list)?|block(?:list|ed)/i;
+  if (SSRF_SINK.test(code) && !SSRF_GUARD.test(code)) {
+    const line = lineOf(code, code.search(SSRF_SINK));
+    push({
+      id: `csharp-ssrf:${fp}:${line}`, file: fp, line,
+      vuln: 'SSRF — HTTP client fetch from a non-validated URL (C#)',
+      severity: 'high', cwe: 'CWE-918', family: 'ssrf', parser: 'CSHARP', confidence: 0.55,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
+      remediation: 'Validate the URL host against an allow-list and reject RFC1918 / link-local / metadata (169.254.169.254) addresses before fetching.',
+    });
+  }
+
+  return findings;
+}

package/src/sast/csharp.js

@@ -531,6 +531,9 @@ function detectOpenRedirect(file, raw, ir, analysis, out, seen) {
       // URL is non-local. We still flag it because Juliet expects the
       // detection — but downgrade the severity.
       const isLocalRedirect = call.method === 'LocalRedirect';
+      // A LocalRedirect / Redirect guarded by Url.IsLocalUrl is the documented
+      // safe pattern — don't flag it (avoids FP on hardened handlers).
+      if ((isLocalRedirect || /\bUrl\.IsLocalUrl\b/.test(raw)) && /\bUrl\.IsLocalUrl\b/.test(raw)) continue;
       const id = `csharp-open-redirect:${file}:${call.line}`;
       if (seen.has(id)) continue;
       seen.add(id);

package/src/sast/csrf.js

@@ -21,11 +21,28 @@ const STATE_CHANGE_RE = {
   django: /\b(?:require_POST|require_http_methods\s*\(\s*\[[^\]]*['"](POST|PUT|PATCH|DELETE)['"])/gi,
   fastapi: /@\w+\s*\.\s*(post|put|patch|delete)\s*\(/gi,
   spring: /@(PostMapping|PutMapping|PatchMapping|DeleteMapping)\b/g,
+  // Symfony: reading the POST body bag (`$request->request->get(...)`) is the
+  // state-change signal, plus the Route annotation method list.
+  symfony: /\$\w+\s*->\s*(?:request|getPayload\s*\(\s*\))\s*->\s*(?:get|getInt|getBoolean|getAlnum|getDigits|all|has)\s*\(|[#@]\[?\s*Route\s*\([^)]*methods\s*[:=]\s*[[{][^\]}]*['"](?:POST|PUT|PATCH|DELETE)['"]/gi,
+  // Go (gin/echo/fiber/chi/mux): a router POST/PUT/PATCH/DELETE registration,
+  // or net/http mux `.Methods("POST")`.
+  go: /\b\w+\s*\.\s*(?:POST|PUT|PATCH|DELETE)\s*\(\s*["'`]|\.\s*Methods\s*\(\s*["'](?:POST|PUT|PATCH|DELETE)["']/g,
+  // Ruby on Rails: a route declaration `post '/x'` / `patch` / `put` / `delete`
+  // (in routes.rb) or `resources :x` (full CRUD incl. state-changing verbs).
+  ruby: /^\s*(?:post|put|patch|delete)\s+['":]|\bresources\s+:/gim,
+  // C# ASP.NET MVC/Web API: a [HttpPost]/[HttpPut]/[HttpPatch]/[HttpDelete]
+  // action attribute.
+  csharp: /\[\s*Http(?:Post|Put|Patch|Delete)\b/g,
 };
 
-const CSRF_DEFENCE_RE = /\b(?:csurf|csrfProtection|csrf\(\)|express-csrf-token|lusca\.csrf|fastify-csrf|CSRFProtect|csrf_protect|CsrfViewMiddleware|CsrfFilter|@CsrfProtected|sameSite\s*[:=]\s*['"](?:Strict|Lax)['"]|origin\s*===|referer\s*===|Origin\s*===|Referer\s*===)/i;
+const CSRF_DEFENCE_RE = /\b(?:csurf|csrfProtection|csrf\(\)|express-csrf-token|lusca\.csrf|fastify-csrf|CSRFProtect|csrf_protect|CsrfViewMiddleware|CsrfFilter|@CsrfProtected|isCsrfTokenValid|IsCsrfTokenValid|csrf_token|CsrfToken|ValidateAntiForgeryToken|AutoValidateAntiforgeryToken|IAntiforgery|protect_from_forgery|verify_authenticity_token|form_authenticity_token|gorilla\/csrf|csrf\.Protect|nosurf|sameSite\s*[:=]\s*['"](?:Strict|Lax)['"]|origin\s*===|referer\s*===|Origin\s*===|Referer\s*===)/i;
 
-const TOKEN_AUTH_RE = /\b(?:Authorization\s*:\s*Bearer|\.startsWith\s*\(\s*['"`]Bearer|req\.headers\.authorization|request\.headers\.get\(\s*['"`]authorization|bearer\s+token|x-api-key|verifyJWT|jwt\.verify|jsonwebtoken)/i;
+// Token-auth signals — these auth schemes are CSRF-safe by construction (the
+// credential rides in a header the browser never auto-attaches). NOTE: bare
+// `[Authorize]` is intentionally NOT here — ASP.NET cookie auth is the default
+// and stays CSRF-vulnerable; only an explicit Bearer scheme or [ApiController]
+// (which disables antiforgery + implies token auth) exempts.
+const TOKEN_AUTH_RE = /\b(?:Authorization\s*:\s*Bearer|\.startsWith\s*\(\s*['"`]Bearer|req\.headers\.authorization|request\.headers\.get\(\s*['"`]authorization|bearer\s+token|x-api-key|verifyJWT|jwt\.verify|jsonwebtoken|lexik_jwt|JWTTokenAuthenticator|headers\s*->\s*get\s*\(\s*['"]Authorization|c\.GetHeader\s*\(\s*["']Authorization|request\.headers\[["']Authorization)|\[\s*ApiController\b|AuthenticationSchemes\s*=\s*["']?Bearer/i;
 
 const TEST_FILE_RE = /(?:^|\/)(?:tests?|__tests__|specs?|test|fixtures)\//i;
 
@@ -39,9 +56,13 @@ export function scanCSRF(fp, raw) {
   if (/^(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(ext)) langSel = ['express', 'fastify'];
   else if (ext === 'py') langSel = ['flask', 'django', 'fastapi'];
   else if (ext === 'java' || ext === 'kt') langSel = ['spring'];
+  else if (ext === 'php' || ext === 'phtml') langSel = ['symfony'];
+  else if (ext === 'go') langSel = ['go'];
+  else if (ext === 'rb') langSel = ['ruby'];
+  else if (ext === 'cs') langSel = ['csharp'];
   if (!langSel) return [];
 
-  const code = blankComments(raw, ext === 'py' ? 'py' : undefined);
+  const code = blankComments(raw, (ext === 'py' || ext === 'rb') ? 'py' : undefined);
   // Project-wide-ish: if the file shows CSRF defence anywhere or only handles
   // token-authenticated routes, we suppress.
   const csrfInScope = CSRF_DEFENCE_RE.test(code);

package/src/sast/csv-injection.js

@@ -0,0 +1,84 @@
+// CSV / formula injection (CWE-1236) — additive detector.
+//
+// When user-controlled text is written into a CSV/spreadsheet cell that begins
+// with `=`, `+`, `-`, `@`, or a tab/CR, a spreadsheet app (Excel, Sheets,
+// LibreOffice) interprets it as a FORMULA on open — enabling data exfiltration
+// (`=IMPORTXML(...)`), command execution via DDE, or credential phishing. The
+// fix is to neutralize the leading character (prefix with `'`), not HTML/SQL
+// escaping.
+//
+// High precision by construction: we only fire when (a) a CSV/spreadsheet
+// WRITE API is on the line, (b) a user-derived value is referenced on the same
+// statement, and (c) no formula-neutralization helper is present nearby.
+
+import { blankComments } from './_comment-strip.js';
+
+const JS_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const PY_RE = /\.py$/i;
+
+// CSV / spreadsheet write APIs worth flagging (JS + Python).
+const CSV_WRITE = [
+  /\bwriteRecords?\s*\(/,                 // csv-writer createObjectCsvWriter().writeRecords
+  /\bcsv\s*\.\s*stringify\s*\(/,          // csv-stringify
+  /\bstringify\s*\(\s*[^)]*\bcolumns\b/,  // csv-stringify with columns
+  /\bcsvStringify\s*\(/,
+  /\b(?:fastcsv|fast_csv|csvFormat)\s*\(/,
+  /\bXLSX\s*\.\s*utils\s*\.\s*(?:json_to_sheet|aoa_to_sheet|sheet_add)/,
+  /\bwriterow\s*\(|\bwriterows\s*\(|\bwriteheader\s*\(/,   // python csv module
+  /\bcsv\s*\.\s*writer\s*\(/,
+  /\bDictWriter\s*\(/,
+];
+
+// User-derived value hints on the same statement.
+const TAINT_HINT =
+  /\b(?:req\.|request\.|params\.|query\.|body\.|_GET|_POST|_REQUEST|getParameter|\.get\(|user\.|profile\.|\.fields\b|row\.|record\.)/;
+
+// Formula-neutralization already applied → suppress.
+const NEUTRALIZED =
+  /escapeFormula|sanitizeCsv|sanitiseCsv|csvEscape|formulaEscape|stripFormula|['"`]\s*'\s*['"`]\s*\+|startsWith\(\s*['"`][=+\-@]|replace\(\s*\/\^\[=/;
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+export function scanCsvInjection(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  const isJs = JS_RE.test(fp), isPy = PY_RE.test(fp);
+  if (!isJs && !isPy) return [];
+  // Cheap pre-filter.
+  if (!/csv|writeRecords|XLSX|writerow|DictWriter|stringify/i.test(raw)) return [];
+
+  const code = blankComments(raw, isPy ? 'py' : undefined);
+  const lines = code.split('\n');
+  const findings = [];
+  const seen = new Set();
+
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!CSV_WRITE.some(re => re.test(line))) continue;
+    if (!TAINT_HINT.test(line)) continue;
+    // Look at the line plus a small window for an explicit neutralizer.
+    const lo = Math.max(0, i - 4);
+    const near = lines.slice(lo, i + 2).join('\n');
+    if (NEUTRALIZED.test(near)) continue;
+    if (seen.has(i + 1)) continue;
+    seen.add(i + 1);
+    findings.push({
+      id: `csv-injection:${fp}:${i + 1}`,
+      severity: 'medium',
+      file: fp,
+      line: i + 1,
+      vuln: 'CSV / formula injection (untrusted data written to a spreadsheet cell)',
+      cwe: 'CWE-1236',
+      family: 'injection',
+      parser: 'SAST',
+      confidence: 0.55,
+      description:
+        'User-controlled text is written to a CSV/spreadsheet without neutralizing leading formula ' +
+        'characters (= + - @ tab). A spreadsheet app will execute it as a formula on open, enabling ' +
+        'data exfiltration (e.g. =IMPORTXML), DDE command execution, or phishing.',
+      remediation:
+        "Prefix any cell value that starts with = + - @ or a tab/CR with a single quote (or strip it), " +
+        'using a dedicated CSV-escaping helper. HTML/SQL escaping does not address this.',
+    });
+  }
+  return findings;
+}

package/src/sast/event-entrypoint.js

@@ -0,0 +1,90 @@
+// R6 (PRD §5) — non-HTTP entrypoint taint. Route-rooted analysis goes blind to
+// message-queue consumers, scheduled tasks, and serverless handlers — exactly
+// where high-severity backend bugs live. This recognizes those entrypoints,
+// treats their payload parameter as an untrusted source, and flags when it
+// reaches a code/command/SQL sink without sanitization.
+//
+// Precision-first: gated to files that register such an entrypoint; tracks the
+// handler's payload parameter (+ common member accesses) into a dangerous sink.
+
+import { blankComments } from './_comment-strip.js';
+
+// Entrypoint registrations → the untrusted payload parameter name they bind.
+const ENTRYPOINTS = [
+  // JS: queue/stream consumers — .on('message', (msg)=>…) / .subscribe((msg)=>…)
+  { re: /\.(?:on|subscribe|consume|process)\s*\(\s*(?:['"][^'"]*['"]\s*,\s*)?(?:async\s*)?\(?\s*([A-Za-z_$][\w$]*)/g, lang: 'js' },
+  // JS serverless: exports.handler = async (event) => … / module.exports.handler = (event)
+  { re: /(?:exports\.\w+|module\.exports(?:\.\w+)?)\s*=\s*(?:async\s*)?\(?\s*([A-Za-z_$][\w$]*)/g, lang: 'js' },
+  // Python Celery / serverless: @app.task / @shared_task / def handler(event, context)
+  { re: /@(?:app|celery|shared)\w*\.task[^\n]*\n\s*def\s+\w+\s*\(\s*([A-Za-z_]\w*)/g, lang: 'py' },
+  { re: /\bdef\s+(?:handler|lambda_handler|handle|consume|on_message|process)\s*\(\s*([A-Za-z_]\w*)/g, lang: 'py' },
+];
+
+// Context markers that indicate an event/queue/serverless file.
+const CONTEXT = /(kafka|rabbit|amqp|sqs|sns|pubsub|kinesis|@app\.task|shared_task|lambda_handler|exports\.handler|celery|bull|bullmq|@SqsListener|@KafkaListener|@RabbitListener|@Scheduled|consumer|EventBridge|cloudevent)/i;
+
+const SINKS = [
+  { re: /\b(?:exec|execSync|spawn|spawnSync)\s*\(/, label: 'command exec', cwe: '78', fam: 'command-injection' },
+  { re: /\beval\s*\(|\bnew\s+Function\s*\(/, label: 'eval', cwe: '94', fam: 'code-injection' },
+  { re: /\bos\.system\s*\(|\bsubprocess\.(?:run|call|Popen|check_output)\s*\(/, label: 'command exec', cwe: '78', fam: 'command-injection' },
+  { re: /\.(?:query|execute|raw)\s*\(\s*[`'"][^`'"]*\$?\{?\s*\+?/, label: 'SQL query (concatenated)', cwe: '89', fam: 'sql-injection' },
+];
+
+const SANITIZER = /\b(sanitiz|validate|escape|allowlist|allow_list|whitelist|schema\.(?:parse|validate)|zod|joi|pydantic|is_safe|verify)/i;
+
+const PAYLOAD_MEMBER = /\.(?:body|value|data|message|payload|Records|detail|content|text)\b/;
+
+export function scanEventEntrypoints(fp, raw) {
+  if (typeof raw !== 'string' || !raw) return [];
+  if (!/\.(?:js|jsx|ts|tsx|mjs|cjs|py)$/i.test(fp)) return [];
+  const code = blankComments(raw);
+  if (!CONTEXT.test(code)) return [];
+  const isPy = /\.py$/i.test(fp);
+  const lines = code.split('\n');
+
+  // Collect payload variable names from entrypoint registrations.
+  const payloads = new Set();
+  for (const ep of ENTRYPOINTS) {
+    if (ep.lang === 'py' !== isPy) continue;
+    const re = new RegExp(ep.re.source, ep.re.flags);
+    let m;
+    while ((m = re.exec(code))) {
+      const name = m[1];
+      if (name && !['async', 'function', 'context', 'self', 'cls'].includes(name)) payloads.add(name);
+    }
+  }
+  if (!payloads.size) return [];
+
+  const findings = [];
+  const seen = new Set();
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    for (const sink of SINKS) {
+      if (!sink.re.test(line)) continue;
+      const arg = line.slice(line.search(sink.re));
+      const hit = [...payloads].some((p) => new RegExp(`\\b${p}\\b`).test(arg));
+      if (!hit) continue;
+      // Sanitizer anywhere in a small window above suppresses.
+      const near = lines.slice(Math.max(0, i - 6), i + 1).join('\n');
+      if (SANITIZER.test(near)) continue;
+      const key = `${i + 1}:${sink.fam}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({
+        id: `event-entrypoint:${fp}:${i + 1}`,
+        severity: 'high',
+        file: fp,
+        line: i + 1,
+        vuln: `Untrusted event/message payload reaches ${sink.label}`,
+        cwe: `CWE-${sink.cwe}`,
+        family: sink.fam,
+        parser: 'EVENT-FLOW',
+        description: `A non-HTTP entrypoint (queue consumer / scheduled task / serverless handler) passes its untrusted payload into ${sink.label} without validation. Message/event bodies are attacker-influenceable just like HTTP input.`,
+        remediation: 'Validate/parse the event payload against a schema before use, and avoid passing it to a command/code/SQL sink (parameterize, use argv-form exec).',
+      });
+    }
+  }
+  return findings;
+}
+
+export const _internals = { PAYLOAD_MEMBER };

package/src/sast/frontend-hygiene.js

@@ -0,0 +1,106 @@
+// Front-end security hygiene — additive, high-precision client-side checks
+// that the engine did not previously cover. None of these change existing
+// findings; each emits its own finding class.
+//
+//   1. Reverse tabnabbing (CWE-1022): `<a target="_blank">` without
+//      `rel="noopener"` — the opened page can rewrite `window.opener.location`
+//      and phish. (Modern browsers default to noopener, so: low.)
+//   2. Missing Subresource Integrity (CWE-353): a cross-origin
+//      `<script src="https://cdn…">` / `<link rel=stylesheet href="//…">`
+//      with no `integrity=` — a compromised/MITM'd CDN executes in your origin.
+//   3. Angular sanitizer bypass (CWE-79): `DomSanitizer.bypassSecurityTrust*`
+//      with a non-literal argument explicitly disables Angular's built-in XSS
+//      protection on attacker-influenced data.
+
+import { blankComments } from './_comment-strip.js';
+
+const MARKUP_RE = /\.(?:html?|jsx|tsx|vue|svelte|php|erb|ejs|hbs|handlebars|astro)$/i;
+const SCRIPT_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs)$/i;
+
+const A_BLANK_RE   = /<a\b[^>]*\btarget\s*=\s*["']_blank["'][^>]*>/gi;
+const REL_NOOPENER = /\brel\s*=\s*["'][^"']*\bno(?:opener|referrer)\b/i;
+
+const EXT_SCRIPT_RE = /<script\b[^>]*\bsrc\s*=\s*["'](?:https?:)?\/\/[^"']+["'][^>]*>/gi;
+const EXT_LINK_RE   = /<link\b[^>]*\bhref\s*=\s*["'](?:https?:)?\/\/[^"']+["'][^>]*>/gi;
+const HAS_INTEGRITY = /\bintegrity\s*=/i;
+const IS_STYLESHEET = /\brel\s*=\s*["'][^"']*\bstylesheet\b/i;
+
+const NG_BYPASS_RE = /\.bypassSecurityTrust(?:Html|Script|Style|Url|ResourceUrl)\s*\(\s*([^)]*?)\)/g;
+// A pure string literal argument is a developer-controlled constant — safe.
+const PURE_LITERAL = /^\s*(['"`])(?:\\.|(?!\1).)*\1\s*$/;
+
+function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+export function scanFrontendHygiene(fp, raw) {
+  if (!raw || raw.length > 500_000) return [];
+  const isMarkup = MARKUP_RE.test(fp);
+  const isScript = SCRIPT_RE.test(fp);
+  if (!isMarkup && !isScript) return [];
+
+  const findings = [];
+
+  if (isMarkup) {
+    // 1. Reverse tabnabbing.
+    A_BLANK_RE.lastIndex = 0;
+    let m;
+    while ((m = A_BLANK_RE.exec(raw))) {
+      if (REL_NOOPENER.test(m[0])) continue;
+      findings.push({
+        id: `tabnabbing:${fp}:${lineOf(raw, m.index)}`,
+        severity: 'low', file: fp, line: lineOf(raw, m.index),
+        vuln: 'Reverse tabnabbing (target="_blank" without rel="noopener")',
+        cwe: 'CWE-1022', family: 'client-side', parser: 'SAST',
+        description: 'A link opens a new tab with target="_blank" but no rel="noopener". The destination page receives a reference to window.opener and can redirect this tab to a phishing page.',
+        remediation: 'Add rel="noopener noreferrer" (or rel="noopener") to every target="_blank" link.',
+      });
+    }
+    // 2. Missing SRI on cross-origin <script>.
+    EXT_SCRIPT_RE.lastIndex = 0;
+    while ((m = EXT_SCRIPT_RE.exec(raw))) {
+      if (HAS_INTEGRITY.test(m[0])) continue;
+      findings.push({
+        id: `missing-sri-script:${fp}:${lineOf(raw, m.index)}`,
+        severity: 'medium', file: fp, line: lineOf(raw, m.index),
+        vuln: 'Missing Subresource Integrity on cross-origin <script>',
+        cwe: 'CWE-353', family: 'supply-chain', parser: 'SAST',
+        description: 'A script is loaded from a third-party origin without an integrity= hash. If that host (or a CDN in front of it) is compromised or MITM\'d, arbitrary code runs in your origin.',
+        remediation: 'Add an integrity="sha384-…" attribute and crossorigin="anonymous", or self-host the asset.',
+      });
+    }
+    // 2b. Missing SRI on cross-origin stylesheet <link>.
+    EXT_LINK_RE.lastIndex = 0;
+    while ((m = EXT_LINK_RE.exec(raw))) {
+      if (!IS_STYLESHEET.test(m[0])) continue;
+      if (HAS_INTEGRITY.test(m[0])) continue;
+      findings.push({
+        id: `missing-sri-link:${fp}:${lineOf(raw, m.index)}`,
+        severity: 'low', file: fp, line: lineOf(raw, m.index),
+        vuln: 'Missing Subresource Integrity on cross-origin stylesheet',
+        cwe: 'CWE-353', family: 'supply-chain', parser: 'SAST',
+        description: 'A stylesheet is loaded from a third-party origin without an integrity= hash, so a compromised CDN can inject CSS-based exfiltration / UI redress.',
+        remediation: 'Add integrity="sha384-…" + crossorigin="anonymous", or self-host the stylesheet.',
+      });
+    }
+  }
+
+  if (isScript) {
+    // 3. Angular sanitizer bypass with a non-literal argument.
+    const code = blankComments(raw);
+    NG_BYPASS_RE.lastIndex = 0;
+    let m;
+    while ((m = NG_BYPASS_RE.exec(code))) {
+      const arg = (m[1] || '').trim();
+      if (!arg || PURE_LITERAL.test(arg)) continue; // constant → safe
+      findings.push({
+        id: `ng-sanitizer-bypass:${fp}:${lineOf(code, m.index)}`,
+        severity: 'high', file: fp, line: lineOf(code, m.index),
+        vuln: 'Angular sanitizer bypass on dynamic value (bypassSecurityTrust*)',
+        cwe: 'CWE-79', family: 'xss', parser: 'SAST',
+        description: 'DomSanitizer.bypassSecurityTrust* explicitly disables Angular\'s built-in XSS protection. Called on a non-constant value, attacker-influenced data reaches the DOM unsanitized.',
+        remediation: 'Avoid bypassSecurityTrust* on dynamic data; bind trusted values only, or sanitize with DomSanitizer.sanitize() / a strict allow-list first.',
+      });
+    }
+  }
+
+  return findings;
+}

package/src/sast/go-structural.js

@@ -0,0 +1,60 @@
+// Go structural (taint-independent) injection detectors — PRD Tier 1 (Go recall).
+//
+// Go handler FNs: user input from c.Query / r.URL.Query().Get is built into a
+// sink via fmt.Sprintf or string concat (Go has no string templates). That
+// shape is the vulnerability regardless of variable names. Parameterized
+// queries (`db.Query("… ?", x)`) and canonicalized paths have no Sprintf/concat
+// in the sink argument, so they don't match.
+
+import { blankComments } from './_comment-strip.js';
+
+const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
+
+export function scanGoStructural(fp, raw) {
+  if (!/\.go$/i.test(fp)) return [];
+  if (!raw || raw.length > 500_000) return [];
+  const code = blankComments(raw);
+  const findings = [];
+  const seen = new Set();
+  const emit = (key, line, meta) => {
+    const id = `go-struct-${key}:${fp}:${line}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    findings.push({
+      id, file: fp, line, vuln: meta.vuln, severity: meta.severity, cwe: meta.cwe,
+      family: meta.family, parser: 'GO', confidence: meta.confidence ?? 0.72,
+      snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200), remediation: meta.remediation,
+    });
+  };
+
+  // SQL injection: a database/sql query method built with fmt.Sprintf or concat.
+  const SQL_RE = /\.(?:Query|QueryRow|QueryContext|QueryRowContext|Exec|ExecContext|Prepare|PrepareContext)\s*\(\s*(?:fmt\.Sprintf\s*\(|"[^"\n]*"\s*\+)/g;
+  let m;
+  while ((m = SQL_RE.exec(code))) emit('sqli', lineOf(code, m.index), {
+    vuln: 'SQL Injection — query built with fmt.Sprintf / concat (Go)',
+    severity: 'critical', cwe: 'CWE-89', family: 'sql-injection', confidence: 0.75,
+    remediation: 'Use parameter placeholders: db.Query("… WHERE name = ?", name). Never build SQL with fmt.Sprintf or string concatenation.',
+  });
+
+  // Path traversal: an os/ioutil file op built with concat or fmt.Sprintf.
+  const PATH_RE = /\b(?:os\.Open|os\.OpenFile|os\.ReadFile|os\.Create|ioutil\.ReadFile|ioutil\.WriteFile)\s*\(\s*(?:"[^"\n]*"\s*\+|fmt\.Sprintf\s*\()/g;
+  while ((m = PATH_RE.exec(code))) emit('path', lineOf(code, m.index), {
+    vuln: 'Path Traversal — file path built with concat / fmt.Sprintf (Go)',
+    severity: 'high', cwe: 'CWE-22', family: 'path-traversal', confidence: 0.7,
+    remediation: 'Strip the path with filepath.Base and assert containment: want := filepath.Join(base, filepath.Base(name)); if !strings.HasPrefix(filepath.Clean(want), base) { reject }.',
+  });
+
+  // Insecure deserialization: encoding/gob decoding attacker-controlled bytes
+  // into an interface{} / any target — gob will instantiate registered concrete
+  // types, a deserialization gadget surface. Gated on encoding/gob being used.
+  if (/\bencoding\/gob\b|\bgob\.NewDecoder\b/.test(code)) {
+    const GOB_RE = /\bgob\.NewDecoder\s*\([\s\S]*?\)\s*\.\s*Decode\s*\(|\b\w+\s*:?=\s*gob\.NewDecoder\s*\(/g;
+    while ((m = GOB_RE.exec(code))) emit('gob-deser', lineOf(code, m.index), {
+      vuln: 'Insecure Deserialization — encoding/gob decoding untrusted input (Go)',
+      severity: 'high', cwe: 'CWE-502', family: 'insecure-deserialization', confidence: 0.6,
+      remediation: 'Do not gob-decode data from an untrusted source — gob instantiates registered concrete types and is not designed for adversarial input. Use a schema-validated format (JSON with a fixed struct, protobuf) and validate before use.',
+    });
+  }
+
+  return findings;
+}

package/src/sast/iac-terraform.js

@@ -0,0 +1,107 @@
+// R18 (PRD §5) — semantic IaC (Terraform), variable-resolving.
+//
+// Regex IaC (engine.js scanIaC) matches literals on one line. Its blind spot is
+// indirection: `cidr_blocks = [var.ingress]` where `variable "ingress"` defaults
+// to "0.0.0.0/0" is wide-open, but the literal never appears on the resource
+// line. This resolves `variable` defaults and `local` values, then evaluates a
+// few high-signal misconfigurations on the RESOLVED value — catching what the
+// literal scan misses, and reporting when the exposure arrives via a variable.
+//
+// Regex-based HCL (no new dep, consistent with the repo); bounded to the
+// highest-signal AWS checks. Real `terraform plan` ingestion is the remainder.
+
+const VAR_DEFAULT = /variable\s+"([^"]+)"\s*\{[^{}]*?default\s*=\s*(?:"([^"]*)"|(\[[^\]]*\]|true|false|[\w.\-]+))/g;
+const LOCAL_BLOCK = /locals\s*\{([\s\S]*?)\n\}/g;
+
+function buildResolver(text) {
+  const vars = new Map();
+  let m;
+  VAR_DEFAULT.lastIndex = 0;
+  while ((m = VAR_DEFAULT.exec(text))) vars.set(m[1], (m[2] !== undefined ? m[2] : m[3] || '').trim());
+  const locals = new Map();
+  LOCAL_BLOCK.lastIndex = 0;
+  while ((m = LOCAL_BLOCK.exec(text))) {
+    for (const line of m[1].split('\n')) {
+      const lm = line.match(/^\s*([A-Za-z_][\w-]*)\s*=\s*(?:"([^"]*)"|([\w.\-]+))/);
+      if (lm) locals.set(lm[1], (lm[2] !== undefined ? lm[2] : lm[3] || '').trim());
+    }
+  }
+  // Resolve a raw attribute value (possibly `var.x`, `local.y`, a list, or literal).
+  return function resolve(raw) {
+    if (raw == null) return { value: '', viaVar: false };
+    // Strip bracket/brace/quote noise anywhere (the attr capture can include a
+    // trailing `}` / `]`), so a `var.x` token matches the resolver exactly.
+    let v = String(raw).replace(/[[\]{}'"]/g, '').trim();
+    const vm = v.match(/^var\.([\w-]+)$/);
+    if (vm && vars.has(vm[1])) return { value: vars.get(vm[1]), viaVar: true, varName: vm[1] };
+    const lm = v.match(/^local\.([\w-]+)$/);
+    if (lm && locals.has(lm[1])) return { value: locals.get(lm[1]), viaVar: true, varName: `local.${lm[1]}` };
+    return { value: v, viaVar: false };
+  };
+}
+
+function lineOf(text, idx) { return text.slice(0, idx).split('\n').length; }
+
+const CHECKS = [
+  {
+    id: 'open-ingress', cwe: 'CWE-284', sev: 'high',
+    attr: /\b(?:cidr_blocks|ipv6_cidr_blocks)\s*=\s*(\[?[^\n]+)/g,
+    bad: (val) => /\b0\.0\.0\.0\/0\b|::\/0\b/.test(val),
+    vuln: 'Terraform: security-group ingress open to the world (0.0.0.0/0)',
+    fix: 'Restrict cidr_blocks to known networks; never default an ingress CIDR to 0.0.0.0/0.',
+  },
+  {
+    id: 'public-bucket', cwe: 'CWE-732', sev: 'high',
+    attr: /\bacl\s*=\s*(\S+)/g,
+    bad: (val) => /^public-read(?:-write)?$/.test(val),
+    vuln: 'Terraform: S3 bucket ACL is public',
+    fix: 'Set acl = "private" and use bucket policies / least-privilege grants instead of a public ACL.',
+  },
+  {
+    id: 'public-db', cwe: 'CWE-668', sev: 'high',
+    attr: /\bpublicly_accessible\s*=\s*(\S+)/g,
+    bad: (val) => /^true$/i.test(val),
+    vuln: 'Terraform: database instance is publicly accessible',
+    fix: 'Set publicly_accessible = false; place the DB in a private subnet.',
+  },
+];
+
+export function scanTerraform(fp, raw) {
+  if (typeof raw !== 'string' || !raw) return [];
+  if (!/\.tf$/i.test(fp)) return [];
+  const resolve = buildResolver(raw);
+  const findings = [];
+  const seen = new Set();
+  for (const check of CHECKS) {
+    const re = new RegExp(check.attr.source, check.attr.flags);
+    let m;
+    while ((m = re.exec(raw))) {
+      const rawVal = m[1];
+      // A literal list may hold several entries; resolve each token.
+      const tokens = rawVal.replace(/^\[|\]$/g, '').split(',').map(t => t.trim()).filter(Boolean);
+      let hit = null;
+      for (const tok of tokens.length ? tokens : [rawVal]) {
+        const r = resolve(tok);
+        if (check.bad(r.value)) { hit = r; break; }
+      }
+      if (!hit) continue;
+      const line = lineOf(raw, m.index);
+      const key = `${check.id}:${line}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      findings.push({
+        id: `iac-tf:${check.id}:${fp}:${line}`,
+        severity: check.sev,
+        file: fp,
+        line,
+        vuln: check.vuln,
+        cwe: check.cwe,
+        family: 'iac-misconfig',
+        parser: 'IAC-TF',
+        description: `${check.vuln}.${hit.viaVar ? ` The unsafe value arrives via \`${hit.varName}\` (resolved to "${hit.value}") — a literal-only scan would miss this.` : ''}`,
+        remediation: check.fix,
+      });
+    }
+  }
+  return findings;
+}