circle-ir 3.119.0 → 3.123.0

package/dist/browser/circle-ir.js

@@ -12924,7 +12924,11 @@ var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.META\b/, sourceType: "http_header" },
   { pattern: /\brequest\.FILES\b/, sourceType: "file_input" },
   { pattern: /\brequest\.query_params\b/, sourceType: "http_param" },
-  { pattern: /\brequest\.path_params\b/, sourceType: "http_param" }
+  { pattern: /\brequest\.path_params\b/, sourceType: "http_param" },
+  // Sprint 72 (#183 residual): builtin `input()` is a stdin user-input
+  // source. Already registered in configs/sources/python.json; add to the
+  // regex registry so it's recognized in subscript/var contexts.
+  { pattern: /\binput\s*\(/, sourceType: "io_input" }
 ];
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
@@ -16226,7 +16230,32 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
         if (isBash && bashSafeBuiltins.has(call.method_name)) {
           continue;
         }
-        const sink = isBash ? {
+        if (isBash && taintedArgPositions.length > 0) {
+          const terminatorPos = call.arguments.filter((a) => a.expression === "--").map((a) => a.position).reduce((min, p) => min === null || p < min ? p : min, null);
+          const earliestTainted = Math.min(...taintedArgPositions);
+          if (terminatorPos !== null && terminatorPos < earliestTainted) {
+            const allTaintedQuoted = taintedArgPositions.every((p) => {
+              const a = call.arguments[p];
+              if (!a) return false;
+              const expr = a.expression.trim();
+              return expr.startsWith('"') && expr.endsWith('"');
+            });
+            if (allTaintedQuoted) {
+              continue;
+            }
+          }
+        }
+        const bashSqlCliTools = /* @__PURE__ */ new Set(["sqlite3", "mysql", "psql", "mariadb"]);
+        const isBashSqlCli = isBash && bashSqlCliTools.has(call.method_name);
+        const sink = isBashSqlCli ? {
+          type: "sql_injection",
+          cwe: "CWE-89",
+          location: `Tainted data (${taintedArgVars.join(", ")}) interpolated into SQL query passed to ${call.method_name}`,
+          line: call.location.line,
+          confidence: 0.7,
+          method: call.method_name,
+          argPositions: taintedArgPositions
+        } : isBash ? {
           type: "command_injection",
           cwe: "CWE-78",
           location: `Tainted data (${taintedArgVars.join(", ")}) passed unquoted to shell utility ${call.method_name}`,
@@ -23106,6 +23135,113 @@ function truncate(s, maxLen) {
   return s.length > maxLen ? s.slice(0, maxLen) + "..." : s;
 }
 
+// src/analysis/html/vue-template-xss-pass.ts
+var DANGEROUS_BINDINGS = /* @__PURE__ */ new Set([
+  "v-html",
+  "v-bind:innerhtml",
+  ":innerhtml",
+  "v-bind:outerhtml",
+  ":outerhtml"
+]);
+var ID_RE = /\b([A-Za-z_$][A-Za-z0-9_$]*)\b/g;
+var RESERVED = /* @__PURE__ */ new Set([
+  "true",
+  "false",
+  "null",
+  "undefined",
+  "this",
+  "new",
+  "typeof",
+  "void",
+  "delete",
+  "instanceof",
+  "in",
+  "of",
+  "Math",
+  "Number",
+  "String",
+  "Boolean",
+  "Array",
+  "Object",
+  "JSON"
+]);
+function runVueTemplateXssChecks(rootNode, filePath, scriptResults) {
+  const taintedNames = collectTaintedNames(scriptResults);
+  if (taintedNames.size === 0) return [];
+  const findings = [];
+  const stack = [rootNode];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node.type === "start_tag" || node.type === "self_closing_tag") {
+      checkElementBindings(node, filePath, taintedNames, findings);
+    }
+    for (let i2 = node.childCount - 1; i2 >= 0; i2--) {
+      const c = node.child(i2);
+      if (c) stack.push(c);
+    }
+  }
+  return findings;
+}
+function checkElementBindings(tag, filePath, tainted, out2) {
+  for (let i2 = 0; i2 < tag.childCount; i2++) {
+    const attr = tag.child(i2);
+    if (!attr || attr.type !== "attribute") continue;
+    const nameNode = findChildByType2(attr, "attribute_name");
+    if (!nameNode) continue;
+    const lcName = nameNode.text.toLowerCase();
+    if (!DANGEROUS_BINDINGS.has(lcName)) continue;
+    const valueNode = findChildByType2(attr, "quoted_attribute_value") ?? findChildByType2(attr, "attribute_value");
+    if (!valueNode) continue;
+    const rhs = stripQuotes2(valueNode.text);
+    if (!rhs.trim()) continue;
+    const matched = matchTaint(rhs, tainted);
+    if (!matched) continue;
+    const line = nameNode.startPosition.row + 1;
+    out2.push({
+      id: `vue-template-xss-${filePath}-${line}-${lcName}`,
+      pass: "vue-template-xss",
+      category: "security",
+      rule_id: "vue-template-xss",
+      cwe: "CWE-79",
+      severity: "high",
+      level: "error",
+      message: `Vue template attribute "${nameNode.text}" binds tainted identifier "${matched}" \u2014 writes raw HTML (XSS risk).`,
+      file: filePath,
+      line,
+      snippet: `${nameNode.text}="${rhs}"`
+    });
+  }
+}
+function matchTaint(rhs, tainted) {
+  ID_RE.lastIndex = 0;
+  let m;
+  while ((m = ID_RE.exec(rhs)) !== null) {
+    const id = m[1];
+    if (RESERVED.has(id)) continue;
+    if (tainted.has(id)) return id;
+  }
+  return void 0;
+}
+function collectTaintedNames(blocks) {
+  const names = /* @__PURE__ */ new Set();
+  for (const { ir } of blocks) {
+    const sourceLines = /* @__PURE__ */ new Set();
+    for (const source of ir.taint.sources) {
+      sourceLines.add(source.line);
+      if (source.variable) names.add(source.variable);
+    }
+    for (const def of ir.dfg.defs) {
+      if (sourceLines.has(def.line) && def.variable) names.add(def.variable);
+    }
+    for (const flow of ir.taint.flows ?? []) {
+      for (const step of flow.path ?? []) {
+        if (step.variable) names.add(step.variable);
+      }
+    }
+  }
+  return names;
+}
+
 // src/analysis/html/html-merge.ts
 function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   const allTypes = [];
@@ -23421,7 +23557,12 @@ var PYTHON_TAINTED_PATTERNS2 = [
   { pattern: /\bget_form_parameter\s*\(/, type: "http_body" },
   { pattern: /\bget_query_parameter\s*\(/, type: "http_param" },
   { pattern: /\bget_header_value\s*\(/, type: "http_header" },
-  { pattern: /\bget_cookie_value\s*\(/, type: "http_cookie" }
+  { pattern: /\bget_cookie_value\s*\(/, type: "http_cookie" },
+  // Sprint 72 (#183 residual): `input()` is registered in
+  // configs/sources/python.json but was not in the forward-taint regex
+  // registry, so `name = input()` was not added to pyTaintedVars. Closes
+  // the deferred `getattr(obj, input())()` reflection-invocation shape.
+  { pattern: /\binput\s*\(/, type: "io_input" }
 ];
 var LanguageSourcesPass = class {
   name = "language-sources";
@@ -23480,6 +23621,21 @@ var LanguageSourcesPass = class {
           });
         }
       }
+      for (const r of findPythonReflectionInvocationSinks(code, pyTaintedVars)) {
+        const alreadyExists = additionalSinks.some(
+          (s) => s.line === r.sinkLine && s.type === "code_injection" && s.method === r.method
+        );
+        if (!alreadyExists) {
+          additionalSinks.push({
+            type: "code_injection",
+            cwe: "CWE-94",
+            line: r.sinkLine,
+            location: `reflection invocation (getattr result called) with tainted attribute name at line ${r.sinkLine}`,
+            method: r.method,
+            confidence: 0.85
+          });
+        }
+      }
     }
     const jsTaintedVars = buildJavaScriptTaintedVars(code, language);
     if (language === "bash") {
@@ -23498,10 +23654,28 @@ var LanguageSourcesPass = class {
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findPythonRangeCheckGuardSanitizers(code));
+      const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
+      for (const finding of pyMisconfigFindings) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+      const rustMisconfigFindings = findRustPatternFindings(code, graph.ir.meta.file);
+      for (const finding of rustMisconfigFindings) {
+        ctx.addFinding(finding);
+      }
+    }
+    if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
+      const exfilFindings = findExternalSecretExfiltrationFindings(
+        code,
+        graph.ir.meta.file,
+        language
+      );
+      for (const finding of exfilFindings) {
+        ctx.addFinding(finding);
+      }
     }
     attachSourceLineCode(additionalSources, additionalSinks, code);
     return { additionalSources, additionalSinks, additionalSanitizers, pyTaintedVars, pySanitizedVars, jsTaintedVars };
@@ -24059,6 +24233,44 @@ function findPythonReturnXSSSinks(sourceCode, taintedVars) {
   }
   return sinks;
 }
+function findPythonReflectionInvocationSinks(sourceCode, taintedVars) {
+  if (taintedVars.size === 0) return [];
+  const sinks = [];
+  const lines = sourceCode.split("\n");
+  const directRe = /\bgetattr\s*\(\s*[^,()]+\s*,\s*([A-Za-z_][\w]*)\s*\)\s*\(/;
+  const bindRe = /^\s*([A-Za-z_][\w]*)\s*=\s*getattr\s*\(\s*[^,()]+\s*,\s*([A-Za-z_][\w]*)\s*\)\s*$/;
+  const aliases = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trimStart().startsWith("#")) continue;
+    const dm = line.match(directRe);
+    if (dm && taintedVars.has(dm[1])) {
+      sinks.push({ sinkLine: i2 + 1, method: "getattr" });
+      continue;
+    }
+    const bm = line.match(bindRe);
+    if (bm && taintedVars.has(bm[2])) {
+      aliases.push({ name: bm[1], bindLine: i2 + 1 });
+    }
+  }
+  if (aliases.length === 0) return sinks;
+  const firedBindLines = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trimStart().startsWith("#")) continue;
+    const lineNum = i2 + 1;
+    for (const a of aliases) {
+      if (lineNum <= a.bindLine) continue;
+      if (firedBindLines.has(a.bindLine)) continue;
+      const invokeRe = new RegExp(`(?<![\\w.])${a.name}\\s*\\(`);
+      if (invokeRe.test(line)) {
+        sinks.push({ sinkLine: a.bindLine, method: "getattr" });
+        firedBindLines.add(a.bindLine);
+      }
+    }
+  }
+  return sinks;
+}
 function findJavaScriptDOMSinks(sourceCode, language) {
   if (!["javascript", "typescript"].includes(language)) return [];
   const sinks = [];
@@ -24250,9 +24462,33 @@ function findBashTaintSources(sourceCode, dfg) {
   return sources;
 }
 var BASH_CREDENTIAL_PATTERN = /^(.*?)(password|passwd|secret|api_?key|token|auth_token|private_key|access_key)\s*=\s*["']?([^"'\s$][^"'\s]*)["']?\s*$/i;
+var BASH_CHECKSUM_VERIFY_PATTERN = /\b(?:sha(?:1|224|256|384|512)sum|md5sum|cksum|b2sum)\s+(?:-c\b|--check\b)/;
+function collectChecksumVerifiedTmpPaths(lines) {
+  const verified = /* @__PURE__ */ new Set();
+  for (const line of lines) {
+    if (!BASH_CHECKSUM_VERIFY_PATTERN.test(line)) continue;
+    const matches = line.match(/\/tmp\/[^\s"'$|`]+/g);
+    if (!matches) continue;
+    for (const p of matches) verified.add(p);
+  }
+  return verified;
+}
+var BASH_ARCHIVE_EXT_PATTERN = /\.(?:tgz|tar\.gz|tar\.bz2|tar\.xz|tar|tbz2|txz|zip|gz|bz2|xz|7z)$/i;
+function isArchiveOutputContext(line, tmpRel) {
+  if (!BASH_ARCHIVE_EXT_PATTERN.test(tmpRel)) return false;
+  if (/\btar\b/.test(line) && /(?:^|\s)-?[A-Za-z]*c[A-Za-z]*\b/.test(line)) return true;
+  if (/\bzip\b/.test(line) && !/\bunzip\b/.test(line)) return true;
+  if (/\bgzip\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line)) return true;
+  if (/\bbzip2\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line)) return true;
+  if (/\bxz\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line)) return true;
+  if (/\b7z\s+a\b/.test(line)) return true;
+  return false;
+}
 function findBashPatternFindings(sourceCode, file) {
   const findings = [];
   const lines = sourceCode.split("\n");
+  const checksumVerifiedTmpPaths = collectChecksumVerifiedTmpPaths(lines);
+  const scriptHasVerifier = hasIntegrityVerifierAnywhere(lines);
   for (let i2 = 0; i2 < lines.length; i2++) {
     const line = lines[i2];
     const trimmed = line.trim();
@@ -24294,19 +24530,25 @@ function findBashPatternFindings(sourceCode, file) {
     }
     const tmpMatch = trimmed.match(/\/tmp\/([^\s"'$]+)/);
     if (tmpMatch && !/mktemp/.test(trimmed)) {
-      findings.push({
-        id: `predictable-temp-file-${file}-${lineNumber}`,
-        pass: "language-sources",
-        category: "security",
-        rule_id: "predictable-temp-file",
-        cwe: "CWE-377",
-        severity: "medium",
-        level: "warning",
-        message: `Predictable temp file: /tmp/${tmpMatch[1]}. Use mktemp instead`,
-        file,
-        line: lineNumber,
-        snippet: trimmed.substring(0, 80)
-      });
+      const tmpRel = tmpMatch[1];
+      const tmpPath = `/tmp/${tmpRel}`;
+      const isChecksumVerified = checksumVerifiedTmpPaths.has(tmpPath);
+      const isArchiveOutput = isArchiveOutputContext(trimmed, tmpRel);
+      if (!isChecksumVerified && !isArchiveOutput) {
+        findings.push({
+          id: `predictable-temp-file-${file}-${lineNumber}`,
+          pass: "language-sources",
+          category: "security",
+          rule_id: "predictable-temp-file",
+          cwe: "CWE-377",
+          severity: "medium",
+          level: "warning",
+          message: `Predictable temp file: /tmp/${tmpRel}. Use mktemp instead`,
+          file,
+          line: lineNumber,
+          snippet: trimmed.substring(0, 80)
+        });
+      }
     }
     if (/\bchmod\b/.test(trimmed) && /\b(777|666)\b/.test(trimmed)) {
       const mode = trimmed.match(/\b(777|666)\b/)[1];
@@ -24339,9 +24581,78 @@ function findBashPatternFindings(sourceCode, file) {
         snippet: trimmed.substring(0, 80)
       });
     }
+    if (!scriptHasVerifier) {
+      const installer = matchUnverifiedPackageInstall(trimmed);
+      if (installer) {
+        findings.push({
+          id: `unverified-package-install-${file}-${lineNumber}`,
+          pass: "language-sources",
+          category: "security",
+          rule_id: "unverified-package-install",
+          cwe: "CWE-494",
+          severity: "high",
+          level: "error",
+          message: `Unverified package install via ${installer}: package contents are not integrity-checked (no gpg/sha256sum verify in script)`,
+          file,
+          line: lineNumber,
+          snippet: trimmed.substring(0, 80)
+        });
+      }
+    }
+    const weakHashAlg = matchBashWeakHashCommand(trimmed);
+    if (weakHashAlg) {
+      findings.push({
+        id: `weak-hash-${file}-${lineNumber}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "weak-hash",
+        cwe: "CWE-328",
+        severity: "medium",
+        level: "warning",
+        message: `Weak hash algorithm: ${weakHashAlg} is cryptographically broken. Use sha256sum or sha512sum`,
+        file,
+        line: lineNumber,
+        snippet: trimmed.substring(0, 80)
+      });
+    }
   }
   return findings;
 }
+function matchBashWeakHashCommand(line) {
+  const re = /(?:^|[|;]|&&|\|\|)\s*(md5sum|sha1sum|md5|sha1)\b(?!\s*=)/;
+  const m = line.match(re);
+  if (!m) return null;
+  return m[1];
+}
+function matchUnverifiedPackageInstall(line) {
+  if (/\bdpkg\b/.test(line) && /(?:^|\s)(?:-[a-zA-Z]*[iIU][a-zA-Z]*|--install)\b/.test(line)) {
+    return "dpkg";
+  }
+  if (/\brpm\b/.test(line) && /(?:^|\s)(?:-[a-zA-Z]*[iU][a-zA-Z]*|--install|--upgrade)\b/.test(line) && !/--(?:verify|checksig|erase|query)\b/.test(line)) {
+    return "rpm";
+  }
+  const aptMatch = line.match(/\b(apt-get|apt|aptitude)\s+install\b/);
+  if (aptMatch && /\.deb\b/.test(line)) {
+    return aptMatch[1];
+  }
+  const yumMatch = line.match(/\b(yum|dnf|zypper)\s+install\b/);
+  if (yumMatch && /\.rpm\b/.test(line)) {
+    return yumMatch[1];
+  }
+  return null;
+}
+function hasIntegrityVerifierAnywhere(lines) {
+  const sigRe = /\b(?:gpg(?:v|2)?|gpg)\s+(?:[^|]*\s)?--verify\b/;
+  const rpmSigRe = /\brpm\s+(?:[^|]*\s)?--checksig\b/;
+  const dpkgSigRe = /\bdpkg\s+(?:[^|]*\s)?--verify\b/;
+  const sumRe = /\b(?:sha(?:1|224|256|384|512)sum|md5sum|cksum|b2sum)\s+(?:[^|]*\s)?(?:-c|--check)\b/;
+  for (const line of lines) {
+    if (sigRe.test(line) || rpmSigRe.test(line) || dpkgSigRe.test(line) || sumRe.test(line)) {
+      return true;
+    }
+  }
+  return false;
+}
 function findBashRegexAllowlistSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -24694,6 +25005,388 @@ function findRustCanonicalizeGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function collectEnvSecretVars(lines, language) {
+  const out2 = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (language === "python") {
+      const m = line.match(/^\s*(\w+)\s*=\s*os\.(?:environ\s*[\[.]|getenv\b)/);
+      if (m) out2.set(m[1], i2 + 1);
+    } else if (language === "javascript" || language === "typescript") {
+      const m = line.match(/(?:^|\s|;)(?:const|let|var)\s+(\w+)\s*=\s*process\.env\b/);
+      if (m) out2.set(m[1], i2 + 1);
+    } else if (language === "go") {
+      const m = line.match(/^\s*(\w+)\s*:?=\s*os\.Getenv\s*\(/);
+      if (m) out2.set(m[1], i2 + 1);
+    }
+  }
+  return out2;
+}
+function isExternalHostUrl(url) {
+  const lower = url.toLowerCase();
+  if (!/^https?:\/\//.test(lower)) return false;
+  const host = lower.replace(/^https?:\/\//, "").split(/[/?#:]/)[0];
+  if (!host) return false;
+  if (host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1") return false;
+  if (/^10\./.test(host)) return false;
+  if (/^192\.168\./.test(host)) return false;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return false;
+  if (host.includes(".internal.") || host.endsWith(".internal") || host.startsWith("internal.")) return false;
+  if (host.endsWith(".local") || host.endsWith(".lan") || host.endsWith(".corp")) return false;
+  if (!host.includes(".")) return false;
+  return true;
+}
+function findBalancedCallEnd(code, start2) {
+  let depth = 1;
+  let i2 = start2;
+  let inStr = null;
+  while (i2 < code.length) {
+    const ch = code[i2];
+    if (inStr) {
+      if (ch === "\\") {
+        i2 += 2;
+        continue;
+      }
+      if (ch === inStr) inStr = null;
+    } else {
+      if (ch === '"' || ch === "'" || ch === "`") inStr = ch;
+      else if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) return i2;
+      }
+    }
+    i2++;
+  }
+  return -1;
+}
+function findKwargValueEnd(s, start2) {
+  let depth = 0;
+  let inStr = null;
+  for (let i2 = start2; i2 < s.length; i2++) {
+    const ch = s[i2];
+    if (inStr) {
+      if (ch === "\\") {
+        i2++;
+        continue;
+      }
+      if (ch === inStr) inStr = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      inStr = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") {
+      if (depth === 0) return i2;
+      depth--;
+    } else if (ch === "," && depth === 0) {
+      return i2;
+    }
+  }
+  return s.length;
+}
+function lineOfCharIndex(code, charIdx) {
+  let line = 1;
+  for (let i2 = 0; i2 < charIdx && i2 < code.length; i2++) {
+    if (code[i2] === "\n") line++;
+  }
+  return line;
+}
+function makeExfilFinding(file, line, snippet, fired, receiver) {
+  return {
+    id: `external-secret-exfiltration-${file}-${line}`,
+    pass: "language-sources",
+    category: "security",
+    rule_id: "external-secret-exfiltration",
+    cwe: "CWE-200",
+    severity: "high",
+    level: "error",
+    message: `Environment secret(s) ${fired.join(", ")} transmitted in request body to external host via ${receiver}`,
+    file,
+    line,
+    snippet: snippet.substring(0, 120)
+  };
+}
+function findExternalSecretExfiltrationFindings(code, file, language) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const secretVars = collectEnvSecretVars(lines, language);
+  if (secretVars.size === 0) return out2;
+  if (language === "python") {
+    out2.push(...findPythonExfilCalls(code, file, secretVars));
+  } else if (language === "javascript" || language === "typescript") {
+    out2.push(...findJavaScriptExfilCalls(code, file, secretVars));
+  } else if (language === "go") {
+    out2.push(...findGoExfilCalls(code, file, secretVars));
+  }
+  return out2;
+}
+function findPythonExfilCalls(code, file, secretVars) {
+  const out2 = [];
+  const callRe = /\b(requests|httpx)\.(post|put|patch|delete|request)\s*\(/g;
+  let m;
+  while (m = callRe.exec(code)) {
+    const argStart = m.index + m[0].length;
+    const argEnd = findBalancedCallEnd(code, argStart);
+    if (argEnd < 0) continue;
+    const args2 = code.slice(argStart, argEnd);
+    const urlMatch = args2.match(/^\s*["']([^"']+)["']/);
+    if (!urlMatch) continue;
+    if (!isExternalHostUrl(urlMatch[1])) continue;
+    const headersIdx = args2.search(/\bheaders\s*=/);
+    let headersStr = "";
+    let bodyStr = args2;
+    if (headersIdx >= 0) {
+      const eqIdx = args2.indexOf("=", headersIdx);
+      const valueStart = eqIdx + 1;
+      const headersEnd = findKwargValueEnd(args2, valueStart);
+      headersStr = args2.slice(valueStart, headersEnd);
+      bodyStr = args2.slice(0, headersIdx) + " " + args2.slice(headersEnd);
+    }
+    const fired = [];
+    for (const v of secretVars.keys()) {
+      const re = new RegExp(`\\b${v}\\b`);
+      if (re.test(bodyStr) && !re.test(headersStr)) fired.push(v);
+    }
+    if (fired.length > 0) {
+      const line = lineOfCharIndex(code, m.index);
+      out2.push(
+        makeExfilFinding(file, line, code.slice(m.index, Math.min(argEnd + 1, m.index + 120)), fired, `${m[1]}.${m[2]}`)
+      );
+    }
+  }
+  return out2;
+}
+function findJavaScriptExfilCalls(code, file, secretVars) {
+  const out2 = [];
+  const allLines = code.split("\n");
+  const carriers = /* @__PURE__ */ new Set();
+  const carrierRe = /(?:^|[\s;{])(?:const|let|var)\s+(\w+)\s*=\s*([^;\n]+)/g;
+  let cm;
+  while (cm = carrierRe.exec(code)) {
+    const name2 = cm[1];
+    const rhs = cm[2];
+    for (const v of secretVars.keys()) {
+      if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+        carriers.add(name2);
+        break;
+      }
+    }
+  }
+  const taintedRefs = /* @__PURE__ */ new Set([...secretVars.keys(), ...carriers]);
+  const networkRe = /\b(https?\.(?:request|get)|fetch|axios\.(?:post|put|patch|request|delete))\s*\(/g;
+  let m;
+  while (m = networkRe.exec(code)) {
+    const argStart = m.index + m[0].length;
+    const argEnd = findBalancedCallEnd(code, argStart);
+    if (argEnd < 0) continue;
+    const args2 = code.slice(argStart, argEnd);
+    const urlMatch = args2.match(/^\s*(?:["']([^"']+)["']|`([^`$]+)`)/);
+    if (!urlMatch) continue;
+    const url = urlMatch[1] || urlMatch[2];
+    if (!isExternalHostUrl(url)) continue;
+    const headersIdx = args2.search(/\bheaders\s*:/);
+    let headersStr = "";
+    let restStr = args2;
+    if (headersIdx >= 0) {
+      const valueStart = args2.indexOf(":", headersIdx) + 1;
+      const headersEnd = findKwargValueEnd(args2, valueStart);
+      headersStr = args2.slice(valueStart, headersEnd);
+      restStr = args2.slice(0, headersIdx) + " " + args2.slice(headersEnd);
+    }
+    const fired = /* @__PURE__ */ new Set();
+    for (const v of taintedRefs) {
+      const re = new RegExp(`\\b${v}\\b`);
+      if (re.test(restStr) && !re.test(headersStr)) fired.add(v);
+    }
+    const callLine = lineOfCharIndex(code, m.index);
+    const windowEnd = Math.min(allLines.length, callLine + 20);
+    const writeWindow = allLines.slice(callLine, windowEnd).join("\n");
+    const writeRe = /\b\w+\.(?:write|end)\s*\(\s*(\w+)/g;
+    let wm;
+    while (wm = writeRe.exec(writeWindow)) {
+      if (taintedRefs.has(wm[1])) fired.add(wm[1]);
+    }
+    if (fired.size > 0) {
+      out2.push(
+        makeExfilFinding(
+          file,
+          callLine,
+          code.slice(m.index, Math.min(argEnd + 1, m.index + 120)),
+          [...fired],
+          m[1]
+        )
+      );
+    }
+  }
+  return out2;
+}
+function findGoExfilCalls(code, file, secretVars) {
+  const out2 = [];
+  const patterns = [
+    { re: /\bhttp\.PostForm\s*\(/g, urlArgIndex: 0, receiver: "http.PostForm" },
+    { re: /\bhttp\.Post\s*\(/g, urlArgIndex: 0, receiver: "http.Post" },
+    { re: /\bhttp\.NewRequest\s*\(/g, urlArgIndex: 1, receiver: "http.NewRequest" }
+  ];
+  for (const { re, urlArgIndex, receiver } of patterns) {
+    let m;
+    while (m = re.exec(code)) {
+      const argStart = m.index + m[0].length;
+      const argEnd = findBalancedCallEnd(code, argStart);
+      if (argEnd < 0) continue;
+      const args2 = code.slice(argStart, argEnd);
+      let urlSearchSlice = args2;
+      if (urlArgIndex === 1) {
+        const firstComma = findKwargValueEnd(args2, 0);
+        if (firstComma >= args2.length) continue;
+        urlSearchSlice = args2.slice(firstComma + 1);
+      }
+      const urlMatch = urlSearchSlice.match(/^\s*["`]([^"`]+)["`]/);
+      if (!urlMatch) continue;
+      if (!isExternalHostUrl(urlMatch[1])) continue;
+      const fired = [];
+      for (const v of secretVars.keys()) {
+        if (new RegExp(`\\b${v}\\b`).test(args2)) fired.push(v);
+      }
+      if (fired.length > 0) {
+        const line = lineOfCharIndex(code, m.index);
+        out2.push(
+          makeExfilFinding(file, line, code.slice(m.index, Math.min(argEnd + 1, m.index + 120)), fired, receiver)
+        );
+      }
+    }
+  }
+  return out2;
+}
+function findPythonPatternFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const subscriptHeaderRe = /\.headers\s*\[\s*['"]([^'"]+)['"]\s*\]\s*=\s*(.+)$/;
+  const xfoHits = [];
+  const cspHits = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const lineNumber = i2 + 1;
+    const sm = trimmed.match(subscriptHeaderRe);
+    if (sm) {
+      const headerName = sm[1];
+      const rhs = sm[2].trim();
+      const headerLower = headerName.toLowerCase();
+      if (headerLower === "access-control-allow-origin") {
+        const valMatch = rhs.match(/^['"]\*['"]/);
+        if (valMatch) {
+          out2.push({
+            id: `cors-wildcard-origin-${file}-${lineNumber}`,
+            pass: "language-sources",
+            category: "security",
+            rule_id: "cors-wildcard-origin",
+            cwe: "CWE-942",
+            severity: "medium",
+            level: "warning",
+            message: "CORS Access-Control-Allow-Origin set to wildcard '*': any origin may read responses",
+            file,
+            line: lineNumber,
+            snippet: trimmed.substring(0, 100)
+          });
+        }
+      }
+      if (headerLower === "x-frame-options") {
+        xfoHits.push({ line: lineNumber, value: rhs });
+      } else if (headerLower === "content-security-policy") {
+        cspHits.push({ line: lineNumber, value: rhs });
+      }
+    }
+    if (/\bverify_mode\s*=\s*ssl\.CERT_NONE\b/.test(trimmed)) {
+      out2.push({
+        id: `tls-verify-disabled-${file}-${lineNumber}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "tls-verify-disabled",
+        cwe: "CWE-295",
+        severity: "high",
+        level: "error",
+        message: "TLS certificate verification disabled: ssl context verify_mode set to CERT_NONE",
+        file,
+        line: lineNumber,
+        snippet: trimmed.substring(0, 100)
+      });
+    } else if (/\bcheck_hostname\s*=\s*False\b/.test(trimmed)) {
+      out2.push({
+        id: `tls-verify-disabled-${file}-${lineNumber}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "tls-verify-disabled",
+        cwe: "CWE-295",
+        severity: "high",
+        level: "error",
+        message: "TLS hostname verification disabled: ssl context check_hostname set to False",
+        file,
+        line: lineNumber,
+        snippet: trimmed.substring(0, 100)
+      });
+    }
+  }
+  const restrictiveXfo = xfoHits.find(
+    (h) => /['"](?:DENY|SAMEORIGIN)['"]/i.test(h.value)
+  );
+  const permissiveCsp = cspHits.find((h) => {
+    const pm = h.value.match(/['"]([^'"]+)['"]/);
+    if (!pm) return false;
+    const policy = pm[1];
+    const faMatch = policy.match(/frame-ancestors\s+([^;]+)/i);
+    if (!faMatch) return false;
+    const directive = faMatch[1].trim();
+    return /(^|\s)\*(\s|$)/.test(directive) || /\bhttps?:\/\//i.test(directive);
+  });
+  if (restrictiveXfo && permissiveCsp) {
+    out2.push({
+      id: `xfo-csp-mismatch-${file}-${restrictiveXfo.line}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xfo-csp-mismatch",
+      cwe: "CWE-1021",
+      severity: "medium",
+      level: "warning",
+      message: "X-Frame-Options/CSP frame-ancestors mismatch: XFO restricts framing but CSP frame-ancestors is permissive (CSP overrides on modern browsers)",
+      file,
+      line: restrictiveXfo.line,
+      snippet: lines[restrictiveXfo.line - 1].trim().substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findRustPatternFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const re = /\.\s*(danger_accept_invalid_certs|danger_accept_invalid_hostnames)\s*\(\s*true\s*\)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    const m = trimmed.match(re);
+    if (!m) continue;
+    const method = m[1];
+    const what = method === "danger_accept_invalid_certs" ? "certificate" : "hostname";
+    out2.push({
+      id: `tls-verify-disabled-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "tls-verify-disabled",
+      cwe: "CWE-295",
+      severity: "high",
+      level: "error",
+      message: `TLS ${what} verification disabled: reqwest builder ${method}(true)`,
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
 
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [
@@ -35512,6 +36205,10 @@ async function analyzeMarkupFile(code, filePath, options, language) {
       }
     }
     const attributeFindings = runHtmlAttributeSecurityChecks(tree.rootNode, filePath);
+    if (language === "vue") {
+      const vueXss = runVueTemplateXssChecks(tree.rootNode, filePath, scriptResults);
+      if (vueXss.length > 0) attributeFindings.push(...vueXss);
+    }
     const result = mergeHtmlResults(meta, scriptResults, attributeFindings);
     result.parse_status = htmlParseStatus;
     logger.debug("HTML analysis complete", {