circle-ir 3.121.0 → 3.124.0

package/dist/browser/circle-ir.js

@@ -12924,7 +12924,11 @@ var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.META\b/, sourceType: "http_header" },
   { pattern: /\brequest\.FILES\b/, sourceType: "file_input" },
   { pattern: /\brequest\.query_params\b/, sourceType: "http_param" },
-  { pattern: /\brequest\.path_params\b/, sourceType: "http_param" }
+  { pattern: /\brequest\.path_params\b/, sourceType: "http_param" },
+  // Sprint 72 (#183 residual): builtin `input()` is a stdin user-input
+  // source. Already registered in configs/sources/python.json; add to the
+  // regex registry so it's recognized in subscript/var contexts.
+  { pattern: /\binput\s*\(/, sourceType: "io_input" }
 ];
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
@@ -16226,7 +16230,32 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
         if (isBash && bashSafeBuiltins.has(call.method_name)) {
           continue;
         }
-        const sink = isBash ? {
+        if (isBash && taintedArgPositions.length > 0) {
+          const terminatorPos = call.arguments.filter((a) => a.expression === "--").map((a) => a.position).reduce((min, p) => min === null || p < min ? p : min, null);
+          const earliestTainted = Math.min(...taintedArgPositions);
+          if (terminatorPos !== null && terminatorPos < earliestTainted) {
+            const allTaintedQuoted = taintedArgPositions.every((p) => {
+              const a = call.arguments[p];
+              if (!a) return false;
+              const expr = a.expression.trim();
+              return expr.startsWith('"') && expr.endsWith('"');
+            });
+            if (allTaintedQuoted) {
+              continue;
+            }
+          }
+        }
+        const bashSqlCliTools = /* @__PURE__ */ new Set(["sqlite3", "mysql", "psql", "mariadb"]);
+        const isBashSqlCli = isBash && bashSqlCliTools.has(call.method_name);
+        const sink = isBashSqlCli ? {
+          type: "sql_injection",
+          cwe: "CWE-89",
+          location: `Tainted data (${taintedArgVars.join(", ")}) interpolated into SQL query passed to ${call.method_name}`,
+          line: call.location.line,
+          confidence: 0.7,
+          method: call.method_name,
+          argPositions: taintedArgPositions
+        } : isBash ? {
           type: "command_injection",
           cwe: "CWE-78",
           location: `Tainted data (${taintedArgVars.join(", ")}) passed unquoted to shell utility ${call.method_name}`,
@@ -23528,7 +23557,12 @@ var PYTHON_TAINTED_PATTERNS2 = [
   { pattern: /\bget_form_parameter\s*\(/, type: "http_body" },
   { pattern: /\bget_query_parameter\s*\(/, type: "http_param" },
   { pattern: /\bget_header_value\s*\(/, type: "http_header" },
-  { pattern: /\bget_cookie_value\s*\(/, type: "http_cookie" }
+  { pattern: /\bget_cookie_value\s*\(/, type: "http_cookie" },
+  // Sprint 72 (#183 residual): `input()` is registered in
+  // configs/sources/python.json but was not in the forward-taint regex
+  // registry, so `name = input()` was not added to pyTaintedVars. Closes
+  // the deferred `getattr(obj, input())()` reflection-invocation shape.
+  { pattern: /\binput\s*\(/, type: "io_input" }
 ];
 var LanguageSourcesPass = class {
   name = "language-sources";
@@ -23587,6 +23621,21 @@ var LanguageSourcesPass = class {
           });
         }
       }
+      for (const r of findPythonReflectionInvocationSinks(code, pyTaintedVars)) {
+        const alreadyExists = additionalSinks.some(
+          (s) => s.line === r.sinkLine && s.type === "code_injection" && s.method === r.method
+        );
+        if (!alreadyExists) {
+          additionalSinks.push({
+            type: "code_injection",
+            cwe: "CWE-94",
+            line: r.sinkLine,
+            location: `reflection invocation (getattr result called) with tainted attribute name at line ${r.sinkLine}`,
+            method: r.method,
+            confidence: 0.85
+          });
+        }
+      }
     }
     const jsTaintedVars = buildJavaScriptTaintedVars(code, language);
     if (language === "bash") {
@@ -23605,10 +23654,37 @@ var LanguageSourcesPass = class {
     if (language === "python") {
       additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findPythonRangeCheckGuardSanitizers(code));
+      const pyMisconfigFindings = findPythonPatternFindings(code, graph.ir.meta.file);
+      for (const finding of pyMisconfigFindings) {
+        ctx.addFinding(finding);
+      }
     }
     if (language === "rust") {
       additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
       additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+      const rustMisconfigFindings = findRustPatternFindings(code, graph.ir.meta.file);
+      for (const finding of rustMisconfigFindings) {
+        ctx.addFinding(finding);
+      }
+    }
+    if (language === "javascript" || language === "typescript" || language === "htmljs") {
+      additionalSanitizers.push(...findJsSafeJsonParseSanitizers(code));
+      additionalSanitizers.push(...findJsCryptoHashSanitizers(code));
+      additionalSanitizers.push(...findJsCsvFormulaPrefixSanitizers(code));
+      additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
+    }
+    if (language === "java") {
+      additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
+    }
+    if (language === "python" || language === "javascript" || language === "typescript" || language === "go") {
+      const exfilFindings = findExternalSecretExfiltrationFindings(
+        code,
+        graph.ir.meta.file,
+        language
+      );
+      for (const finding of exfilFindings) {
+        ctx.addFinding(finding);
+      }
     }
     attachSourceLineCode(additionalSources, additionalSinks, code);
     return { additionalSources, additionalSinks, additionalSanitizers, pyTaintedVars, pySanitizedVars, jsTaintedVars };
@@ -24166,6 +24242,44 @@ function findPythonReturnXSSSinks(sourceCode, taintedVars) {
   }
   return sinks;
 }
+function findPythonReflectionInvocationSinks(sourceCode, taintedVars) {
+  if (taintedVars.size === 0) return [];
+  const sinks = [];
+  const lines = sourceCode.split("\n");
+  const directRe = /\bgetattr\s*\(\s*[^,()]+\s*,\s*([A-Za-z_][\w]*)\s*\)\s*\(/;
+  const bindRe = /^\s*([A-Za-z_][\w]*)\s*=\s*getattr\s*\(\s*[^,()]+\s*,\s*([A-Za-z_][\w]*)\s*\)\s*$/;
+  const aliases = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trimStart().startsWith("#")) continue;
+    const dm = line.match(directRe);
+    if (dm && taintedVars.has(dm[1])) {
+      sinks.push({ sinkLine: i2 + 1, method: "getattr" });
+      continue;
+    }
+    const bm = line.match(bindRe);
+    if (bm && taintedVars.has(bm[2])) {
+      aliases.push({ name: bm[1], bindLine: i2 + 1 });
+    }
+  }
+  if (aliases.length === 0) return sinks;
+  const firedBindLines = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.trimStart().startsWith("#")) continue;
+    const lineNum = i2 + 1;
+    for (const a of aliases) {
+      if (lineNum <= a.bindLine) continue;
+      if (firedBindLines.has(a.bindLine)) continue;
+      const invokeRe = new RegExp(`(?<![\\w.])${a.name}\\s*\\(`);
+      if (invokeRe.test(line)) {
+        sinks.push({ sinkLine: a.bindLine, method: "getattr" });
+        firedBindLines.add(a.bindLine);
+      }
+    }
+  }
+  return sinks;
+}
 function findJavaScriptDOMSinks(sourceCode, language) {
   if (!["javascript", "typescript"].includes(language)) return [];
   const sinks = [];
@@ -24383,6 +24497,7 @@ function findBashPatternFindings(sourceCode, file) {
   const findings = [];
   const lines = sourceCode.split("\n");
   const checksumVerifiedTmpPaths = collectChecksumVerifiedTmpPaths(lines);
+  const scriptHasVerifier = hasIntegrityVerifierAnywhere(lines);
   for (let i2 = 0; i2 < lines.length; i2++) {
     const line = lines[i2];
     const trimmed = line.trim();
@@ -24475,9 +24590,78 @@ function findBashPatternFindings(sourceCode, file) {
         snippet: trimmed.substring(0, 80)
       });
     }
+    if (!scriptHasVerifier) {
+      const installer = matchUnverifiedPackageInstall(trimmed);
+      if (installer) {
+        findings.push({
+          id: `unverified-package-install-${file}-${lineNumber}`,
+          pass: "language-sources",
+          category: "security",
+          rule_id: "unverified-package-install",
+          cwe: "CWE-494",
+          severity: "high",
+          level: "error",
+          message: `Unverified package install via ${installer}: package contents are not integrity-checked (no gpg/sha256sum verify in script)`,
+          file,
+          line: lineNumber,
+          snippet: trimmed.substring(0, 80)
+        });
+      }
+    }
+    const weakHashAlg = matchBashWeakHashCommand(trimmed);
+    if (weakHashAlg) {
+      findings.push({
+        id: `weak-hash-${file}-${lineNumber}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "weak-hash",
+        cwe: "CWE-328",
+        severity: "medium",
+        level: "warning",
+        message: `Weak hash algorithm: ${weakHashAlg} is cryptographically broken. Use sha256sum or sha512sum`,
+        file,
+        line: lineNumber,
+        snippet: trimmed.substring(0, 80)
+      });
+    }
   }
   return findings;
 }
+function matchBashWeakHashCommand(line) {
+  const re = /(?:^|[|;]|&&|\|\|)\s*(md5sum|sha1sum|md5|sha1)\b(?!\s*=)/;
+  const m = line.match(re);
+  if (!m) return null;
+  return m[1];
+}
+function matchUnverifiedPackageInstall(line) {
+  if (/\bdpkg\b/.test(line) && /(?:^|\s)(?:-[a-zA-Z]*[iIU][a-zA-Z]*|--install)\b/.test(line)) {
+    return "dpkg";
+  }
+  if (/\brpm\b/.test(line) && /(?:^|\s)(?:-[a-zA-Z]*[iU][a-zA-Z]*|--install|--upgrade)\b/.test(line) && !/--(?:verify|checksig|erase|query)\b/.test(line)) {
+    return "rpm";
+  }
+  const aptMatch = line.match(/\b(apt-get|apt|aptitude)\s+install\b/);
+  if (aptMatch && /\.deb\b/.test(line)) {
+    return aptMatch[1];
+  }
+  const yumMatch = line.match(/\b(yum|dnf|zypper)\s+install\b/);
+  if (yumMatch && /\.rpm\b/.test(line)) {
+    return yumMatch[1];
+  }
+  return null;
+}
+function hasIntegrityVerifierAnywhere(lines) {
+  const sigRe = /\b(?:gpg(?:v|2)?|gpg)\s+(?:[^|]*\s)?--verify\b/;
+  const rpmSigRe = /\brpm\s+(?:[^|]*\s)?--checksig\b/;
+  const dpkgSigRe = /\bdpkg\s+(?:[^|]*\s)?--verify\b/;
+  const sumRe = /\b(?:sha(?:1|224|256|384|512)sum|md5sum|cksum|b2sum)\s+(?:[^|]*\s)?(?:-c|--check)\b/;
+  for (const line of lines) {
+    if (sigRe.test(line) || rpmSigRe.test(line) || dpkgSigRe.test(line) || sumRe.test(line)) {
+      return true;
+    }
+  }
+  return false;
+}
 function findBashRegexAllowlistSanitizers(code) {
   const sanitizers = [];
   const lines = code.split("\n");
@@ -24830,6 +25014,491 @@ function findRustCanonicalizeGuardSanitizers(code) {
   }
   return sanitizers;
 }
+function findJavaSafeJsonParseSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const safeParse = /\.(?:readValue|fromJson)\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (!safeParse.test(lines[i2])) continue;
+    sanitizers.push({
+      type: "java_safe_json_parse",
+      method: "readValue",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsSafeJsonParseSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const safeParse = /\bJSON\.parse\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (!safeParse.test(lines[i2])) continue;
+    sanitizers.push({
+      type: "js_safe_json_parse",
+      method: "JSON.parse",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsCryptoHashSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const hashCall = /\b(?:bcrypt|argon2)\s*\.\s*hash(?:Sync)?\s*\(|\bcrypto\s*\.\s*(?:scrypt(?:Sync)?|createHash)\s*\(|\.digest\s*\(/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (!hashCall.test(lines[i2])) continue;
+    sanitizers.push({
+      type: "js_crypto_hash",
+      method: "hash",
+      line: i2 + 1,
+      sanitizes: ["external_taint_escape"]
+    });
+  }
+  return sanitizers;
+}
+function findJsCsvFormulaPrefixSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const tickPrefix = /`'\$\{/;
+  const concatPrefix = /["']\\?'["']\s*\+\s*[A-Za-z_]/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    if (tickPrefix.test(lines[i2]) || concatPrefix.test(lines[i2])) {
+      sanitizers.push({
+        type: "js_csv_formula_prefix",
+        method: "'-prefix",
+        line: i2 + 1,
+        sanitizes: ["external_taint_escape"]
+      });
+    }
+  }
+  return sanitizers;
+}
+function findJsWrapperFunctionSanitizers(code) {
+  const sanitizers = [];
+  const lines = code.split("\n");
+  const wrappers = /* @__PURE__ */ new Map();
+  const fnDeclRe = /\bfunction\s+([A-Za-z_]\w*)\s*\(/;
+  const arrowDeclRe = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*(?:\([^)]*\)|[A-Za-z_]\w*)\s*=>/;
+  const xssCharClass = /\.replace\s*\(\s*\/[^/]*[&<>"'][^/]*\//;
+  const crlfCharClass = /\.replace\s*\(\s*\/[^/]*(?:\\r|\\n|\\t)[^/]*\//;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const m = fnDeclRe.exec(lines[i2]) ?? arrowDeclRe.exec(lines[i2]);
+    if (!m) continue;
+    const name2 = m[1];
+    const body2 = lines.slice(i2, Math.min(lines.length, i2 + 8)).join("\n");
+    const kinds = /* @__PURE__ */ new Set();
+    if (xssCharClass.test(body2)) {
+      kinds.add("xss");
+      kinds.add("external_taint_escape");
+    }
+    if (crlfCharClass.test(body2)) {
+      kinds.add("log_injection");
+      kinds.add("external_taint_escape");
+    }
+    if (kinds.size > 0) wrappers.set(name2, kinds);
+  }
+  if (wrappers.size === 0) return sanitizers;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    for (const [name2, kinds] of wrappers) {
+      const declSelf = new RegExp(`\\b(?:function|const|let|var)\\s+${name2}\\b`);
+      if (declSelf.test(lines[i2])) continue;
+      const callRe = new RegExp(`\\b${name2}\\s*\\(`);
+      if (!callRe.test(lines[i2])) continue;
+      sanitizers.push({
+        type: "js_wrapper_function",
+        method: name2,
+        line: i2 + 1,
+        sanitizes: [...kinds]
+      });
+    }
+  }
+  return sanitizers;
+}
+function collectEnvSecretVars(lines, language) {
+  const out2 = /* @__PURE__ */ new Map();
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (language === "python") {
+      const m = line.match(/^\s*(\w+)\s*=\s*os\.(?:environ\s*[\[.]|getenv\b)/);
+      if (m) out2.set(m[1], i2 + 1);
+    } else if (language === "javascript" || language === "typescript") {
+      const m = line.match(/(?:^|\s|;)(?:const|let|var)\s+(\w+)\s*=\s*process\.env\b/);
+      if (m) out2.set(m[1], i2 + 1);
+    } else if (language === "go") {
+      const m = line.match(/^\s*(\w+)\s*:?=\s*os\.Getenv\s*\(/);
+      if (m) out2.set(m[1], i2 + 1);
+    }
+  }
+  return out2;
+}
+function isExternalHostUrl(url) {
+  const lower = url.toLowerCase();
+  if (!/^https?:\/\//.test(lower)) return false;
+  const host = lower.replace(/^https?:\/\//, "").split(/[/?#:]/)[0];
+  if (!host) return false;
+  if (host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1") return false;
+  if (/^10\./.test(host)) return false;
+  if (/^192\.168\./.test(host)) return false;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(host)) return false;
+  if (host.includes(".internal.") || host.endsWith(".internal") || host.startsWith("internal.")) return false;
+  if (host.endsWith(".local") || host.endsWith(".lan") || host.endsWith(".corp")) return false;
+  if (!host.includes(".")) return false;
+  return true;
+}
+function findBalancedCallEnd(code, start2) {
+  let depth = 1;
+  let i2 = start2;
+  let inStr = null;
+  while (i2 < code.length) {
+    const ch = code[i2];
+    if (inStr) {
+      if (ch === "\\") {
+        i2 += 2;
+        continue;
+      }
+      if (ch === inStr) inStr = null;
+    } else {
+      if (ch === '"' || ch === "'" || ch === "`") inStr = ch;
+      else if (ch === "(") depth++;
+      else if (ch === ")") {
+        depth--;
+        if (depth === 0) return i2;
+      }
+    }
+    i2++;
+  }
+  return -1;
+}
+function findKwargValueEnd(s, start2) {
+  let depth = 0;
+  let inStr = null;
+  for (let i2 = start2; i2 < s.length; i2++) {
+    const ch = s[i2];
+    if (inStr) {
+      if (ch === "\\") {
+        i2++;
+        continue;
+      }
+      if (ch === inStr) inStr = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      inStr = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{") depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") {
+      if (depth === 0) return i2;
+      depth--;
+    } else if (ch === "," && depth === 0) {
+      return i2;
+    }
+  }
+  return s.length;
+}
+function lineOfCharIndex(code, charIdx) {
+  let line = 1;
+  for (let i2 = 0; i2 < charIdx && i2 < code.length; i2++) {
+    if (code[i2] === "\n") line++;
+  }
+  return line;
+}
+function makeExfilFinding(file, line, snippet, fired, receiver) {
+  return {
+    id: `external-secret-exfiltration-${file}-${line}`,
+    pass: "language-sources",
+    category: "security",
+    rule_id: "external-secret-exfiltration",
+    cwe: "CWE-200",
+    severity: "high",
+    level: "error",
+    message: `Environment secret(s) ${fired.join(", ")} transmitted in request body to external host via ${receiver}`,
+    file,
+    line,
+    snippet: snippet.substring(0, 120)
+  };
+}
+function findExternalSecretExfiltrationFindings(code, file, language) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const secretVars = collectEnvSecretVars(lines, language);
+  if (secretVars.size === 0) return out2;
+  if (language === "python") {
+    out2.push(...findPythonExfilCalls(code, file, secretVars));
+  } else if (language === "javascript" || language === "typescript") {
+    out2.push(...findJavaScriptExfilCalls(code, file, secretVars));
+  } else if (language === "go") {
+    out2.push(...findGoExfilCalls(code, file, secretVars));
+  }
+  return out2;
+}
+function findPythonExfilCalls(code, file, secretVars) {
+  const out2 = [];
+  const callRe = /\b(requests|httpx)\.(post|put|patch|delete|request)\s*\(/g;
+  let m;
+  while (m = callRe.exec(code)) {
+    const argStart = m.index + m[0].length;
+    const argEnd = findBalancedCallEnd(code, argStart);
+    if (argEnd < 0) continue;
+    const args2 = code.slice(argStart, argEnd);
+    const urlMatch = args2.match(/^\s*["']([^"']+)["']/);
+    if (!urlMatch) continue;
+    if (!isExternalHostUrl(urlMatch[1])) continue;
+    const headersIdx = args2.search(/\bheaders\s*=/);
+    let headersStr = "";
+    let bodyStr = args2;
+    if (headersIdx >= 0) {
+      const eqIdx = args2.indexOf("=", headersIdx);
+      const valueStart = eqIdx + 1;
+      const headersEnd = findKwargValueEnd(args2, valueStart);
+      headersStr = args2.slice(valueStart, headersEnd);
+      bodyStr = args2.slice(0, headersIdx) + " " + args2.slice(headersEnd);
+    }
+    const fired = [];
+    for (const v of secretVars.keys()) {
+      const re = new RegExp(`\\b${v}\\b`);
+      if (re.test(bodyStr) && !re.test(headersStr)) fired.push(v);
+    }
+    if (fired.length > 0) {
+      const line = lineOfCharIndex(code, m.index);
+      out2.push(
+        makeExfilFinding(file, line, code.slice(m.index, Math.min(argEnd + 1, m.index + 120)), fired, `${m[1]}.${m[2]}`)
+      );
+    }
+  }
+  return out2;
+}
+function findJavaScriptExfilCalls(code, file, secretVars) {
+  const out2 = [];
+  const allLines = code.split("\n");
+  const carriers = /* @__PURE__ */ new Set();
+  const carrierRe = /(?:^|[\s;{])(?:const|let|var)\s+(\w+)\s*=\s*([^;\n]+)/g;
+  let cm;
+  while (cm = carrierRe.exec(code)) {
+    const name2 = cm[1];
+    const rhs = cm[2];
+    for (const v of secretVars.keys()) {
+      if (new RegExp(`\\b${v}\\b`).test(rhs)) {
+        carriers.add(name2);
+        break;
+      }
+    }
+  }
+  const taintedRefs = /* @__PURE__ */ new Set([...secretVars.keys(), ...carriers]);
+  const networkRe = /\b(https?\.(?:request|get)|fetch|axios\.(?:post|put|patch|request|delete))\s*\(/g;
+  let m;
+  while (m = networkRe.exec(code)) {
+    const argStart = m.index + m[0].length;
+    const argEnd = findBalancedCallEnd(code, argStart);
+    if (argEnd < 0) continue;
+    const args2 = code.slice(argStart, argEnd);
+    const urlMatch = args2.match(/^\s*(?:["']([^"']+)["']|`([^`$]+)`)/);
+    if (!urlMatch) continue;
+    const url = urlMatch[1] || urlMatch[2];
+    if (!isExternalHostUrl(url)) continue;
+    const headersIdx = args2.search(/\bheaders\s*:/);
+    let headersStr = "";
+    let restStr = args2;
+    if (headersIdx >= 0) {
+      const valueStart = args2.indexOf(":", headersIdx) + 1;
+      const headersEnd = findKwargValueEnd(args2, valueStart);
+      headersStr = args2.slice(valueStart, headersEnd);
+      restStr = args2.slice(0, headersIdx) + " " + args2.slice(headersEnd);
+    }
+    const fired = /* @__PURE__ */ new Set();
+    for (const v of taintedRefs) {
+      const re = new RegExp(`\\b${v}\\b`);
+      if (re.test(restStr) && !re.test(headersStr)) fired.add(v);
+    }
+    const callLine = lineOfCharIndex(code, m.index);
+    const windowEnd = Math.min(allLines.length, callLine + 20);
+    const writeWindow = allLines.slice(callLine, windowEnd).join("\n");
+    const writeRe = /\b\w+\.(?:write|end)\s*\(\s*(\w+)/g;
+    let wm;
+    while (wm = writeRe.exec(writeWindow)) {
+      if (taintedRefs.has(wm[1])) fired.add(wm[1]);
+    }
+    if (fired.size > 0) {
+      out2.push(
+        makeExfilFinding(
+          file,
+          callLine,
+          code.slice(m.index, Math.min(argEnd + 1, m.index + 120)),
+          [...fired],
+          m[1]
+        )
+      );
+    }
+  }
+  return out2;
+}
+function findGoExfilCalls(code, file, secretVars) {
+  const out2 = [];
+  const patterns = [
+    { re: /\bhttp\.PostForm\s*\(/g, urlArgIndex: 0, receiver: "http.PostForm" },
+    { re: /\bhttp\.Post\s*\(/g, urlArgIndex: 0, receiver: "http.Post" },
+    { re: /\bhttp\.NewRequest\s*\(/g, urlArgIndex: 1, receiver: "http.NewRequest" }
+  ];
+  for (const { re, urlArgIndex, receiver } of patterns) {
+    let m;
+    while (m = re.exec(code)) {
+      const argStart = m.index + m[0].length;
+      const argEnd = findBalancedCallEnd(code, argStart);
+      if (argEnd < 0) continue;
+      const args2 = code.slice(argStart, argEnd);
+      let urlSearchSlice = args2;
+      if (urlArgIndex === 1) {
+        const firstComma = findKwargValueEnd(args2, 0);
+        if (firstComma >= args2.length) continue;
+        urlSearchSlice = args2.slice(firstComma + 1);
+      }
+      const urlMatch = urlSearchSlice.match(/^\s*["`]([^"`]+)["`]/);
+      if (!urlMatch) continue;
+      if (!isExternalHostUrl(urlMatch[1])) continue;
+      const fired = [];
+      for (const v of secretVars.keys()) {
+        if (new RegExp(`\\b${v}\\b`).test(args2)) fired.push(v);
+      }
+      if (fired.length > 0) {
+        const line = lineOfCharIndex(code, m.index);
+        out2.push(
+          makeExfilFinding(file, line, code.slice(m.index, Math.min(argEnd + 1, m.index + 120)), fired, receiver)
+        );
+      }
+    }
+  }
+  return out2;
+}
+function findPythonPatternFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const subscriptHeaderRe = /\.headers\s*\[\s*['"]([^'"]+)['"]\s*\]\s*=\s*(.+)$/;
+  const xfoHits = [];
+  const cspHits = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const lineNumber = i2 + 1;
+    const sm = trimmed.match(subscriptHeaderRe);
+    if (sm) {
+      const headerName = sm[1];
+      const rhs = sm[2].trim();
+      const headerLower = headerName.toLowerCase();
+      if (headerLower === "access-control-allow-origin") {
+        const valMatch = rhs.match(/^['"]\*['"]/);
+        if (valMatch) {
+          out2.push({
+            id: `cors-wildcard-origin-${file}-${lineNumber}`,
+            pass: "language-sources",
+            category: "security",
+            rule_id: "cors-wildcard-origin",
+            cwe: "CWE-942",
+            severity: "medium",
+            level: "warning",
+            message: "CORS Access-Control-Allow-Origin set to wildcard '*': any origin may read responses",
+            file,
+            line: lineNumber,
+            snippet: trimmed.substring(0, 100)
+          });
+        }
+      }
+      if (headerLower === "x-frame-options") {
+        xfoHits.push({ line: lineNumber, value: rhs });
+      } else if (headerLower === "content-security-policy") {
+        cspHits.push({ line: lineNumber, value: rhs });
+      }
+    }
+    if (/\bverify_mode\s*=\s*ssl\.CERT_NONE\b/.test(trimmed)) {
+      out2.push({
+        id: `tls-verify-disabled-${file}-${lineNumber}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "tls-verify-disabled",
+        cwe: "CWE-295",
+        severity: "high",
+        level: "error",
+        message: "TLS certificate verification disabled: ssl context verify_mode set to CERT_NONE",
+        file,
+        line: lineNumber,
+        snippet: trimmed.substring(0, 100)
+      });
+    } else if (/\bcheck_hostname\s*=\s*False\b/.test(trimmed)) {
+      out2.push({
+        id: `tls-verify-disabled-${file}-${lineNumber}`,
+        pass: "language-sources",
+        category: "security",
+        rule_id: "tls-verify-disabled",
+        cwe: "CWE-295",
+        severity: "high",
+        level: "error",
+        message: "TLS hostname verification disabled: ssl context check_hostname set to False",
+        file,
+        line: lineNumber,
+        snippet: trimmed.substring(0, 100)
+      });
+    }
+  }
+  const restrictiveXfo = xfoHits.find(
+    (h) => /['"](?:DENY|SAMEORIGIN)['"]/i.test(h.value)
+  );
+  const permissiveCsp = cspHits.find((h) => {
+    const pm = h.value.match(/['"]([^'"]+)['"]/);
+    if (!pm) return false;
+    const policy = pm[1];
+    const faMatch = policy.match(/frame-ancestors\s+([^;]+)/i);
+    if (!faMatch) return false;
+    const directive = faMatch[1].trim();
+    return /(^|\s)\*(\s|$)/.test(directive) || /\bhttps?:\/\//i.test(directive);
+  });
+  if (restrictiveXfo && permissiveCsp) {
+    out2.push({
+      id: `xfo-csp-mismatch-${file}-${restrictiveXfo.line}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "xfo-csp-mismatch",
+      cwe: "CWE-1021",
+      severity: "medium",
+      level: "warning",
+      message: "X-Frame-Options/CSP frame-ancestors mismatch: XFO restricts framing but CSP frame-ancestors is permissive (CSP overrides on modern browsers)",
+      file,
+      line: restrictiveXfo.line,
+      snippet: lines[restrictiveXfo.line - 1].trim().substring(0, 100)
+    });
+  }
+  return out2;
+}
+function findRustPatternFindings(code, file) {
+  const out2 = [];
+  const lines = code.split("\n");
+  const re = /\.\s*(danger_accept_invalid_certs|danger_accept_invalid_hostnames)\s*\(\s*true\s*\)/;
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const raw = lines[i2];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("//")) continue;
+    const m = trimmed.match(re);
+    if (!m) continue;
+    const method = m[1];
+    const what = method === "danger_accept_invalid_certs" ? "certificate" : "hostname";
+    out2.push({
+      id: `tls-verify-disabled-${file}-${i2 + 1}`,
+      pass: "language-sources",
+      category: "security",
+      rule_id: "tls-verify-disabled",
+      cwe: "CWE-295",
+      severity: "high",
+      level: "error",
+      message: `TLS ${what} verification disabled: reqwest builder ${method}(true)`,
+      file,
+      line: i2 + 1,
+      snippet: trimmed.substring(0, 100)
+    });
+  }
+  return out2;
+}
 
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [