circle-ir 3.111.0 → 3.113.0

package/dist/browser/circle-ir.js

@@ -11948,8 +11948,27 @@ var DEFAULT_SINKS = [
   // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
   // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
+  // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
+  // target `Connection.all`, so class-scoped patterns matching `Connection`
+  // hit (see #186 Sprint 55 matcher extension consulting call.resolution.target).
+  // `exec`/`run`/`all`/`get`/`each` follow the same shape.
+  { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
+  // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
+  // These methods explicitly bypass Angular's built-in sanitizer; passing
+  // tainted strings re-introduces DOM-injection risk. Distinctive method
+  // names — classless + language-scoped is safe.
+  { method: "bypassSecurityTrustHtml", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustScript", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustStyle", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustUrl", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustResourceUrl", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Express.js XSS (response methods)
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -11962,6 +11981,19 @@ var DEFAULT_SINKS = [
   { method: "runInContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInNewContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInThisContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  // `new vm.Script(taint)` — Node core `vm` module compiles strings. The
+  // JS plugin emits method_name = 'vm.Script' for the constructor call;
+  // the matcher's dotted-simple-name fallback (taint-matcher.ts:1664) lets
+  // pattern.method = 'Script' hit on method_name = 'vm.Script'. The
+  // `class: 'constructor'` short-circuit accepts the no-receiver shape.
+  // (#188 Sprint 55)
+  { method: "Script", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // `setImmediate(taintedString)` — like setTimeout/setInterval, Node will
+  // evaluate the first argument when it is a string. The callback-shape
+  // suppression in taint-matcher.ts:1342 already covers setTimeout/
+  // setInterval; the Sprint 55 fix extends that gate to setImmediate too.
+  // (#188 Sprint 55)
+  { method: "setImmediate", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // protobufjs Root.parse(schemaText) compiles a textual schema into JS at runtime;
   // tainted schema → code execution (CVE-2026-41242). Issue #94.
   { method: "parse", class: "protobuf", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -12024,6 +12056,14 @@ var DEFAULT_SINKS = [
   // got library
   { method: "get", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // got/request npm packages default-export a callable function:
+  //   const got = require('got'); got(req.query.url)
+  //   const request = require('request'); request(req.query.url, cb)
+  // The classless method names are distinctive enough (`got`, `request`) that
+  // the FP risk is acceptable; both are scoped to JS/TS so they don't leak
+  // into other plugins. (#185 Sprint 55)
+  { method: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "request", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // superagent
   { method: "get", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -12100,6 +12140,11 @@ var DEFAULT_SINKS = [
   { method: "exec", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "compile", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "__import__", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Python dynamic import — `importlib.import_module(taint)` parallels Java's
+  // `Class.forName`. The bare `__import__` entry above also matches the
+  // `importlib.__import__` form because the sink-matcher is class-agnostic
+  // when a classless entry exists. Sprint 56 #183.
+  { method: "import_module", class: "importlib", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   // Python Deserialization — language-scoped so the lowercase `yaml` / `pickle`
   // module names don't collide with Java locals named `yaml` (SnakeYAML usage).
   { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
@@ -12357,6 +12402,15 @@ var DEFAULT_SINKS = [
   // Standard library logging
   { method: "println!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "eprintln!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
+  // log:: namespaced forms — the Rust macro extractor preserves the full
+  // path prefix in `method_name` (`log::info!`), so the bare entries above
+  // only match the imported form `use log::info; info!(...)`. Sprint 56 #182 Slice A.
+  { method: "log::info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::error!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::debug!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::trace!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
   // Rust sqlx SQL Injection
   { method: "query", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -13538,7 +13592,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
-        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
           if (firstArg && isFunctionCallbackArgument(firstArg)) {
             continue;
@@ -13855,6 +13909,11 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
+      const resolvedTarget = call.resolution?.target;
+      const expectedClassMethodTail = `${pattern.class}.${pattern.method}`;
+      if (resolvedTarget && (resolvedTarget === expectedClassMethodTail || resolvedTarget.endsWith("." + expectedClassMethodTail))) {
+        return true;
+      }
       if (pattern.allow_unresolved_receiver && !call.receiver_type && !call.receiver_type_fqn && call.receiver.includes(".")) {
         return true;
       }
@@ -31280,6 +31339,9 @@ var PY_SECURE_TRUE_RE = /\bsecure\s*=\s*True\b/;
 var PY_HTTPONLY_TRUE_RE = /\bhttponly\s*=\s*True\b/i;
 var JAVA_SET_SECURE_TRUE_RE = /\.setSecure\s*\(\s*true\s*\)/;
 var JAVA_SET_HTTPONLY_TRUE_RE = /\.setHttpOnly\s*\(\s*true\s*\)/;
+var GO_SECURE_TRUE_RE = /\bSecure\s*:\s*true\b/;
+var GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
+var RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
 var InsecureCookiePass = class {
   name = "insecure-cookie";
   category = "security";
@@ -31310,6 +31372,19 @@ var InsecureCookiePass = class {
         insecureCookies.push(det);
         this.emit(ctx, file, det, "java");
       }
+    } else if (language === "go") {
+      for (const call of graph.ir.calls) {
+        const det = this.detectGo(call);
+        if (!det) continue;
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "go");
+      }
+    } else if (language === "rust") {
+      const dets = this.detectRustSetCookieFormat(code);
+      for (const det of dets) {
+        insecureCookies.push(det);
+        this.emit(ctx, file, det, "rust");
+      }
     }
     return { insecureCookies };
   }
@@ -31369,11 +31444,60 @@ var InsecureCookiePass = class {
       optionsPresent: false
     };
   }
+  // ---------------- Go ----------------
+  detectGo(call) {
+    if (call.method_name !== "SetCookie") return null;
+    if ((call.receiver ?? "") !== "http") return null;
+    if (call.arguments.length < 2) return null;
+    const cookieArg = call.arguments.find((a) => a.position === 1);
+    const cookieExpr = (cookieArg?.expression ?? "").trim();
+    if (!cookieExpr.includes("{") || !cookieExpr.includes("}")) return null;
+    const missingSecure = !GO_SECURE_TRUE_RE.test(cookieExpr);
+    const missingHttpOnly = !GO_HTTPONLY_TRUE_RE.test(cookieExpr);
+    if (!missingSecure && !missingHttpOnly) return null;
+    return {
+      line: call.location.line,
+      receiver: "http.SetCookie",
+      missingSecure,
+      missingHttpOnly,
+      optionsPresent: true
+    };
+  }
+  // ---------------- Rust ----------------
+  detectRustSetCookieFormat(code) {
+    const out2 = [];
+    const re = new RegExp(RUST_SET_COOKIE_MACRO_RE.source, RUST_SET_COOKIE_MACRO_RE.flags);
+    let m;
+    while ((m = re.exec(code)) !== null) {
+      const macro = m[1] ?? "";
+      const body2 = m[2] ?? "";
+      const missingSecure = !/\bSecure\b/.test(body2);
+      const missingHttpOnly = !/\bHttpOnly\b/.test(body2);
+      if (!missingSecure && !missingHttpOnly) continue;
+      const line = code.slice(0, m.index).split("\n").length;
+      out2.push({
+        line,
+        receiver: macro,
+        missingSecure,
+        missingHttpOnly,
+        optionsPresent: true
+      });
+    }
+    return out2;
+  }
   emit(ctx, file, det, flavor) {
     const missing = [];
-    if (det.missingSecure) missing.push(flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : "`setSecure(true)`");
-    if (det.missingHttpOnly) missing.push(flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : "`setHttpOnly(true)`");
-    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response.";
+    if (det.missingSecure) {
+      missing.push(
+        flavor === "js" ? "`secure: true`" : flavor === "python" ? "`secure=True`" : flavor === "java" ? "`setSecure(true)`" : flavor === "go" ? "`Secure: true`" : "`Secure` attribute"
+      );
+    }
+    if (det.missingHttpOnly) {
+      missing.push(
+        flavor === "js" ? "`httpOnly: true`" : flavor === "python" ? "`httponly=True`" : flavor === "java" ? "`setHttpOnly(true)`" : flavor === "go" ? "`HttpOnly: true`" : "`HttpOnly` attribute"
+      );
+    }
+    const fix = flavor === "js" ? 'Pass `{ secure: true, httpOnly: true, sameSite: "lax" }` as the third argument to `res.cookie()`.' : flavor === "python" ? 'Pass `secure=True, httponly=True, samesite="Lax"` to `response.set_cookie(...)`.' : flavor === "java" ? "After constructing the cookie, call `cookie.setSecure(true)` and `cookie.setHttpOnly(true)` before adding it to the response." : flavor === "go" ? "Set `Secure: true` and `HttpOnly: true` on the `http.Cookie` struct literal passed to `http.SetCookie`." : "Append `; Secure; HttpOnly` to the `Set-Cookie` header string.";
     ctx.addFinding({
       id: `${this.name}-${file}-${det.line}`,
       pass: this.name,

package/dist/core/circle-ir-core.cjs

@@ -11330,8 +11330,27 @@ var DEFAULT_SINKS = [
   // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
   // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
+  // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
+  // target `Connection.all`, so class-scoped patterns matching `Connection`
+  // hit (see #186 Sprint 55 matcher extension consulting call.resolution.target).
+  // `exec`/`run`/`all`/`get`/`each` follow the same shape.
+  { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
+  // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
+  // These methods explicitly bypass Angular's built-in sanitizer; passing
+  // tainted strings re-introduces DOM-injection risk. Distinctive method
+  // names — classless + language-scoped is safe.
+  { method: "bypassSecurityTrustHtml", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustScript", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustStyle", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustUrl", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustResourceUrl", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Express.js XSS (response methods)
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -11344,6 +11363,19 @@ var DEFAULT_SINKS = [
   { method: "runInContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInNewContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInThisContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  // `new vm.Script(taint)` — Node core `vm` module compiles strings. The
+  // JS plugin emits method_name = 'vm.Script' for the constructor call;
+  // the matcher's dotted-simple-name fallback (taint-matcher.ts:1664) lets
+  // pattern.method = 'Script' hit on method_name = 'vm.Script'. The
+  // `class: 'constructor'` short-circuit accepts the no-receiver shape.
+  // (#188 Sprint 55)
+  { method: "Script", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // `setImmediate(taintedString)` — like setTimeout/setInterval, Node will
+  // evaluate the first argument when it is a string. The callback-shape
+  // suppression in taint-matcher.ts:1342 already covers setTimeout/
+  // setInterval; the Sprint 55 fix extends that gate to setImmediate too.
+  // (#188 Sprint 55)
+  { method: "setImmediate", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // protobufjs Root.parse(schemaText) compiles a textual schema into JS at runtime;
   // tainted schema → code execution (CVE-2026-41242). Issue #94.
   { method: "parse", class: "protobuf", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11406,6 +11438,14 @@ var DEFAULT_SINKS = [
   // got library
   { method: "get", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // got/request npm packages default-export a callable function:
+  //   const got = require('got'); got(req.query.url)
+  //   const request = require('request'); request(req.query.url, cb)
+  // The classless method names are distinctive enough (`got`, `request`) that
+  // the FP risk is acceptable; both are scoped to JS/TS so they don't leak
+  // into other plugins. (#185 Sprint 55)
+  { method: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "request", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // superagent
   { method: "get", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -11482,6 +11522,11 @@ var DEFAULT_SINKS = [
   { method: "exec", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "compile", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "__import__", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Python dynamic import — `importlib.import_module(taint)` parallels Java's
+  // `Class.forName`. The bare `__import__` entry above also matches the
+  // `importlib.__import__` form because the sink-matcher is class-agnostic
+  // when a classless entry exists. Sprint 56 #183.
+  { method: "import_module", class: "importlib", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   // Python Deserialization — language-scoped so the lowercase `yaml` / `pickle`
   // module names don't collide with Java locals named `yaml` (SnakeYAML usage).
   { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
@@ -11739,6 +11784,15 @@ var DEFAULT_SINKS = [
   // Standard library logging
   { method: "println!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "eprintln!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
+  // log:: namespaced forms — the Rust macro extractor preserves the full
+  // path prefix in `method_name` (`log::info!`), so the bare entries above
+  // only match the imported form `use log::info; info!(...)`. Sprint 56 #182 Slice A.
+  { method: "log::info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::error!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::debug!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::trace!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
   // Rust sqlx SQL Injection
   { method: "query", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -12833,7 +12887,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
-        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
           if (firstArg && isFunctionCallbackArgument(firstArg)) {
             continue;
@@ -13150,6 +13204,11 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
+      const resolvedTarget = call.resolution?.target;
+      const expectedClassMethodTail = `${pattern.class}.${pattern.method}`;
+      if (resolvedTarget && (resolvedTarget === expectedClassMethodTail || resolvedTarget.endsWith("." + expectedClassMethodTail))) {
+        return true;
+      }
       if (pattern.allow_unresolved_receiver && !call.receiver_type && !call.receiver_type_fqn && call.receiver.includes(".")) {
         return true;
       }

package/dist/core/circle-ir-core.js

@@ -11264,8 +11264,27 @@ var DEFAULT_SINKS = [
   // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
   // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
   { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
+  // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
+  // target `Connection.all`, so class-scoped patterns matching `Connection`
+  // hit (see #186 Sprint 55 matcher extension consulting call.resolution.target).
+  // `exec`/`run`/`all`/`get`/`each` follow the same shape.
+  { method: "all", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "run", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "each", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "get", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
+  { method: "exec", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"], allow_unresolved_receiver: true },
   // Browser DOM XSS sinks
   { method: "setAttribute", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [1] },
+  // Angular DomSanitizer.bypassSecurityTrust* — CWE-79 (#184 Sprint 55).
+  // These methods explicitly bypass Angular's built-in sanitizer; passing
+  // tainted strings re-introduces DOM-injection risk. Distinctive method
+  // names — classless + language-scoped is safe.
+  { method: "bypassSecurityTrustHtml", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustScript", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustStyle", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustUrl", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "bypassSecurityTrustResourceUrl", type: "xss", cwe: "CWE-79", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Express.js XSS (response methods)
   { method: "send", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
   { method: "write", class: "Response", type: "xss", cwe: "CWE-79", severity: "high", arg_positions: [0] },
@@ -11278,6 +11297,19 @@ var DEFAULT_SINKS = [
   { method: "runInContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInNewContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "runInThisContext", class: "vm", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
+  // `new vm.Script(taint)` — Node core `vm` module compiles strings. The
+  // JS plugin emits method_name = 'vm.Script' for the constructor call;
+  // the matcher's dotted-simple-name fallback (taint-matcher.ts:1664) lets
+  // pattern.method = 'Script' hit on method_name = 'vm.Script'. The
+  // `class: 'constructor'` short-circuit accepts the no-receiver shape.
+  // (#188 Sprint 55)
+  { method: "Script", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // `setImmediate(taintedString)` — like setTimeout/setInterval, Node will
+  // evaluate the first argument when it is a string. The callback-shape
+  // suppression in taint-matcher.ts:1342 already covers setTimeout/
+  // setInterval; the Sprint 55 fix extends that gate to setImmediate too.
+  // (#188 Sprint 55)
+  { method: "setImmediate", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // protobufjs Root.parse(schemaText) compiles a textual schema into JS at runtime;
   // tainted schema → code execution (CVE-2026-41242). Issue #94.
   { method: "parse", class: "protobuf", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11340,6 +11372,14 @@ var DEFAULT_SINKS = [
   // got library
   { method: "get", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // got/request npm packages default-export a callable function:
+  //   const got = require('got'); got(req.query.url)
+  //   const request = require('request'); request(req.query.url, cb)
+  // The classless method names are distinctive enough (`got`, `request`) that
+  // the FP risk is acceptable; both are scoped to JS/TS so they don't leak
+  // into other plugins. (#185 Sprint 55)
+  { method: "got", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "request", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   // superagent
   { method: "get", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   { method: "post", class: "superagent", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
@@ -11416,6 +11456,11 @@ var DEFAULT_SINKS = [
   { method: "exec", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "compile", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   { method: "__import__", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
+  // Python dynamic import — `importlib.import_module(taint)` parallels Java's
+  // `Class.forName`. The bare `__import__` entry above also matches the
+  // `importlib.__import__` form because the sink-matcher is class-agnostic
+  // when a classless entry exists. Sprint 56 #183.
+  { method: "import_module", class: "importlib", type: "code_injection", cwe: "CWE-94", severity: "high", arg_positions: [0], languages: ["python"] },
   // Python Deserialization — language-scoped so the lowercase `yaml` / `pickle`
   // module names don't collide with Java locals named `yaml` (SnakeYAML usage).
   { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
@@ -11673,6 +11718,15 @@ var DEFAULT_SINKS = [
   // Standard library logging
   { method: "println!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
   { method: "eprintln!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2] },
+  // log:: namespaced forms — the Rust macro extractor preserves the full
+  // path prefix in `method_name` (`log::info!`), so the bare entries above
+  // only match the imported form `use log::info; info!(...)`. Sprint 56 #182 Slice A.
+  { method: "log::info!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::warn!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::error!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::debug!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::trace!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
+  { method: "log::log!", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2], languages: ["rust"] },
   // Rust sqlx SQL Injection
   { method: "query", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
   { method: "query_as", class: "sqlx", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -12767,7 +12821,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             }
           }
         }
-        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout")) {
+        if (pattern.type === "code_injection" && (call.method_name === "setInterval" || call.method_name === "setTimeout" || call.method_name === "setImmediate")) {
           const firstArg = call.arguments.find((a) => a.position === 0);
           if (firstArg && isFunctionCallbackArgument(firstArg)) {
             continue;
@@ -13084,6 +13138,11 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
       if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
         return true;
       }
+      const resolvedTarget = call.resolution?.target;
+      const expectedClassMethodTail = `${pattern.class}.${pattern.method}`;
+      if (resolvedTarget && (resolvedTarget === expectedClassMethodTail || resolvedTarget.endsWith("." + expectedClassMethodTail))) {
+        return true;
+      }
       if (pattern.allow_unresolved_receiver && !call.receiver_type && !call.receiver_type_fqn && call.receiver.includes(".")) {
         return true;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.111.0",
+  "version": "3.113.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",