circle-ir 3.126.0 → 3.129.0

package/dist/analysis/passes/language-sources-pass.js

@@ -206,6 +206,11 @@ export class LanguageSourcesPass {
         if (language === 'go') {
             additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findGoHtmlTemplateImportSanitizers(code));
+            // Sprint 78 (#190): Go ECB-mode weak-crypto detection.
+            const goMisconfigFindings = findGoPatternFindings(code, graph.ir.meta.file);
+            for (const finding of goMisconfigFindings) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Python: safe-handler sanitizer detectors (cognium-dev #114 Sprint 31) --
         if (language === 'python') {
@@ -217,6 +222,9 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
             additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
             additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
+            // Sprint 77a (#216 Pattern X): Jinja2 Environment(autoescape=...) +
+            // .render(...) sanitizer.
+            additionalSanitizers.push(...findPythonJinjaAutoescapeSanitizers(code));
             // Sprint 71 (#190): pattern-based misconfig findings for subscript/context
             // assignment shapes (cors-wildcard-origin, xfo-csp-mismatch, tls-verify-
             // disabled) that the language-agnostic detectors miss in Python.
@@ -229,12 +237,30 @@ export class LanguageSourcesPass {
         if (language === 'rust') {
             additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+            // Sprint 77a (#216 Pattern X): argv-form Command::new(literal).arg(...)
+            // sanitizer.
+            additionalSanitizers.push(...findRustArgvCommandSanitizers(code));
             // Sprint 71 (#190): Rust reqwest builder `danger_accept_invalid_*(true)`
             // is `tls-verify-disabled` — same rule as the Python/JS shapes.
             const rustMisconfigFindings = findRustPatternFindings(code, graph.ir.meta.file);
             for (const finding of rustMisconfigFindings) {
                 ctx.addFinding(finding);
             }
+            // Sprint 78 (#190): additional Rust misconfig pattern detectors —
+            // hardcoded-credential, insecure-cookie (builder chain),
+            // jwt-verify-disabled, weak-crypto (raw ECB block ops).
+            for (const finding of findRustHardcodedCredentialFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findRustInsecureCookieFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findRustJwtVerifyDisabledFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
+            for (const finding of findRustWeakCryptoEcbFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- JavaScript/TypeScript: Sprint 73 (#216 Pattern A + B) — ETE
         // sanitizer-chain recognition (JSON.parse / bcrypt.hash / csv
@@ -246,12 +272,27 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
             // Sprint 75 (#216 Pattern D): JS SSRF allow-list guard (var-aware).
             additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
+            // Sprint 78 (#190): JS misconfig pattern findings — libxmljs noent:true.
+            for (const finding of findJsPatternFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // -- Java: Sprint 73 (#216 Pattern A) — Jackson readValue / Gson
         // fromJson recognized as ETE terminator (does not affect
         // configured `deserialization` sinks).
         if (language === 'java') {
             additionalSanitizers.push(...findJavaSafeJsonParseSanitizers(code));
+            // Sprint 76 (#216 Pattern B): Java inline sanitizer recognition.
+            additionalSanitizers.push(...findJavaPathNormalizeStartsWithGuardSanitizers(code));
+            additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
+            // Sprint 77a (#216 Pattern X): argv-form exec sanitizer.
+            additionalSanitizers.push(...findJavaArgvFormExecSanitizers(code));
+            // Sprint 78 (#190): Java misconfig pattern findings —
+            // jwt-verify-disabled (auth0 JWT.decode bare) +
+            // tls-verify-disabled (empty-body X509TrustManager).
+            for (const finding of findJavaPatternFindings(code, graph.ir.meta.file)) {
+                ctx.addFinding(finding);
+            }
         }
         // Sprint 70 (#151): cross-language env-secret → external-network exfiltration.
         // Pattern findings only — no taint flow required (composed-flow shape that
@@ -2928,6 +2969,275 @@ function findJsSsrfAllowlistGuardSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * Java: Path.resolve(...).normalize() + startsWith(ROOT) guard
+ * sanitizer (cognium-dev #216 Sprint 76 Pattern B).
+ *
+ * Pattern recognized:
+ *
+ *   private static final Path ROOT = Paths.get("/data");
+ *   public Path safe(String name) throws Exception {
+ *       Path full = ROOT.resolve(name).normalize();
+ *       if (!full.startsWith(ROOT)) throw new SecurityException("escape");
+ *       return full;
+ *   }
+ *
+ * Note: `.normalize()` alone is not safe (absolute-path arguments
+ * replace ROOT entirely); the load-bearing check is the subsequent
+ * `<full>.startsWith(<ROOT>)` guard with a terminator. Both the
+ * normalize chain and the matching guard must be present to emit
+ * the sanitizer.
+ *
+ * Emits a `path_traversal` + `external_taint_escape` sanitizer at
+ * the resolve line and at every subsequent line that references the
+ * normalized variable.
+ */
+function findJavaPathNormalizeStartsWithGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // <var> = <root>.resolve(<arg>).normalize()
+    // Also accepts Paths.get(<root>, <arg>).normalize() and
+    // Path.of(<root>, <arg>).normalize() chained forms.
+    const resolveNormalizeRe = /\b([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*)\s*\.\s*resolve\s*\([^)]*\)\s*\.\s*normalize\s*\(\s*\)/;
+    const startsWithGuardRe = (varName, rootName) => new RegExp(`if\\s*\\(\\s*!\\s*${varName}\\s*\\.\\s*startsWith\\s*\\(\\s*${rootName}\\s*\\)\\s*\\)`);
+    const terminatorRe = /\b(throw|return)\b/;
+    // First pass: find every normalize-chain declaration and remember
+    // its line + variable + root identifier.
+    const candidates = [];
+    for (let i = 0; i < lines.length; i++) {
+        const m = resolveNormalizeRe.exec(lines[i]);
+        if (!m)
+            continue;
+        candidates.push({ line: i + 1, fullVar: m[1], rootVar: m[2] });
+    }
+    if (candidates.length === 0)
+        return sanitizers;
+    // Second pass: confirm each candidate has a matching startsWith
+    // guard with a terminator on the same or next line.
+    for (const c of candidates) {
+        const guardRe = startsWithGuardRe(c.fullVar, c.rootVar);
+        let guardLine = -1;
+        // Search ahead up to 6 lines for the guard.
+        for (let l = c.line; l < Math.min(lines.length, c.line + 6); l++) {
+            if (!guardRe.test(lines[l]))
+                continue;
+            // The terminator may be on the same line (single-line if) or on
+            // the next line (block-form if).
+            if (terminatorRe.test(lines[l]) ||
+                (l + 1 < lines.length && terminatorRe.test(lines[l + 1]))) {
+                guardLine = l + 1;
+                break;
+            }
+        }
+        if (guardLine < 0)
+            continue;
+        // Emit on the resolve line and on every subsequent line that
+        // references the normalized variable (covers the `return full;`
+        // / `Files.read(full)` / etc. sink sites).
+        const varRefRe = new RegExp(`\\b${c.fullVar}\\b`);
+        sanitizers.push({
+            type: 'java_path_normalize_startswith_guard',
+            method: 'normalize',
+            line: c.line,
+            sanitizes: ['path_traversal', 'external_taint_escape'],
+        });
+        for (let l = c.line; l < lines.length; l++) {
+            if (!varRefRe.test(lines[l]))
+                continue;
+            sanitizers.push({
+                type: 'java_path_normalize_startswith_guard',
+                method: 'normalize',
+                line: l + 1,
+                sanitizes: ['path_traversal', 'external_taint_escape'],
+            });
+        }
+    }
+    return sanitizers;
+}
+/**
+ * Java: inline CRLF/tab-strip wrapper at log-call site (cognium-dev
+ * #216 Sprint 76 Pattern B).
+ *
+ * Pattern recognized:
+ *
+ *   log.info("event=user_lookup value={}", user.replaceAll("[\\r\\n\\t]", "_"));
+ *
+ * The CRLF-strip `.replaceAll("[\\r\\n...]", ...)` (or
+ * `.replace('\\n'|'\\r'|'\\t', ...)`) must appear as a *direct*
+ * argument inside a recognized slf4j/log4j/JUL log-method call on
+ * the same source line. A `.replaceAll(...)` on a different earlier
+ * line (assigned to a temp variable) is NOT recognized — this
+ * preserves TP firing on a separately-tainted log argument.
+ *
+ * Emits a `log_injection` + `external_taint_escape` sanitizer at
+ * that line.
+ */
+function findJavaInlineCrlfStripLogSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // Recognized log method receivers: common slf4j / log4j / JUL
+    // identifiers. Restricted set avoids matching arbitrary
+    // `something.info(...)` calls.
+    const logCallStart = /\b(?:log|logger|LOG|LOGGER|slog|LOGGER_)\s*\.\s*(?:info|warn|error|debug|trace|fatal|severe|warning|fine|finer|finest|config)\s*\(/;
+    // Threat-char regex literal classes that count as a CRLF strip.
+    // Java string-literal escapes use \\r / \\n / \\t inside a "..."
+    // source. We accept either character-class `[...\r\n...]` or a
+    // single-char `replace('\n', ...)` / `replace('\r', ...)` /
+    // `replace('\t', ...)` form.
+    const crlfReplaceAll = /\.\s*replaceAll\s*\(\s*"\[[^"]*\\\\?[rnt][^"]*\]"/;
+    const crlfReplaceChar = /\.\s*replace\s*\(\s*'(?:\\\\?[rnt])'\s*,/;
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i];
+        if (!logCallStart.test(text))
+            continue;
+        if (!crlfReplaceAll.test(text) && !crlfReplaceChar.test(text))
+            continue;
+        sanitizers.push({
+            type: 'java_inline_crlf_strip_log',
+            method: 'replaceAll',
+            line: i + 1,
+            sanitizes: ['log_injection', 'external_taint_escape'],
+        });
+    }
+    return sanitizers;
+}
+/**
+ * Java: argv-form `Runtime.getRuntime().exec(new String[]{...})` and
+ * `new ProcessBuilder(new String[]{...})` sanitizer (cognium-dev #216
+ * Sprint 77a Pattern X).
+ *
+ * Pattern recognized:
+ *
+ *   Runtime.getRuntime().exec(new String[]{"echo", "--", arg});
+ *   new ProcessBuilder(new String[]{"ls", "-l", dir});
+ *
+ * Argv-form exec splits the program and arguments into a fixed array
+ * with no shell interpretation, so a tainted argv element cannot
+ * smuggle shell metacharacters into a separate command. The
+ * single-string form `exec("echo " + arg)` is NOT matched and remains
+ * a `command_injection` finding (TP-1 control).
+ *
+ * Emits a `command_injection` + `external_taint_escape` sanitizer at
+ * that line.
+ */
+function findJavaArgvFormExecSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // .exec(new String[]{...}) -- Runtime, Process, Desktop, etc.
+    const argvExecRe = /\.\s*exec\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+    // new ProcessBuilder(new String[]{...})
+    const argvPbRe = /\bnew\s+ProcessBuilder\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i];
+        if (!argvExecRe.test(text) && !argvPbRe.test(text))
+            continue;
+        sanitizers.push({
+            type: 'java_argv_form_exec',
+            method: 'exec',
+            line: i + 1,
+            sanitizes: ['command_injection', 'external_taint_escape'],
+        });
+    }
+    return sanitizers;
+}
+/**
+ * Rust: argv-form `Command::new("literal").arg(...).arg(...)` sanitizer
+ * (cognium-dev #216 Sprint 77a Pattern X).
+ *
+ * Pattern recognized:
+ *
+ *   Command::new("grep").arg(p).arg("/var/log/app.log").status();
+ *
+ * Argv-form exec with a string-literal program splits arguments into
+ * the argv slot with no shell interpretation. Tainted-program slot
+ * `Command::new(prog).arg(...)` is NOT matched (TP-2 control), and
+ * explicit shell-via-argv `Command::new("sh").arg("-c")` /
+ * `Command::new("bash").arg("-c")` is excluded since `-c` re-enables
+ * shell parsing of the tainted slot.
+ *
+ * Emits a `command_injection` + `external_taint_escape` sanitizer at
+ * that line.
+ */
+function findRustArgvCommandSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // Command::new("LITERAL").arg(... -- literal program + at least one .arg().
+    const argvCommandRe = /\bCommand\s*::\s*new\s*\(\s*"[^"]*"\s*\)\s*\.\s*arg\s*\(/;
+    // Shell-via-argv exclusion: Command::new("sh"/"bash"/...).arg("-c"/...)
+    const shellArgvRe = /\bCommand\s*::\s*new\s*\(\s*"(?:sh|bash|zsh|ksh|dash|cmd(?:\.exe)?|powershell|pwsh)"\s*\)\s*\.\s*arg\s*\(\s*"-c"/;
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i];
+        if (!argvCommandRe.test(text))
+            continue;
+        if (shellArgvRe.test(text))
+            continue;
+        sanitizers.push({
+            type: 'rust_argv_command',
+            method: 'arg',
+            line: i + 1,
+            sanitizes: ['command_injection', 'external_taint_escape'],
+        });
+    }
+    return sanitizers;
+}
+/**
+ * Python: Jinja2 `Environment(..., autoescape=...)` + `.render(...)`
+ * autoescape sanitizer (cognium-dev #216 Sprint 77a Pattern X).
+ *
+ * Pattern recognized:
+ *
+ *   env = Environment(loader=..., autoescape=select_autoescape(["html"]))
+ *   env.get_template("hello.html").render(name=name)
+ *
+ * Autoescape-on environments html-escape all `.render(**ctx)` output
+ * by default, blocking xss. `autoescape=False` / `None` / `0`
+ * environments are NOT matched (TP-3 control), and only env vars
+ * declared with an explicit `autoescape=` keyword argument are
+ * recognized.
+ *
+ * Emits an `xss` + `external_taint_escape` sanitizer at every
+ * `env.get_template(...).render(...)` chained call line.
+ */
+function findPythonJinjaAutoescapeSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // Find Environment(...) assigned to an identifier and require an
+    // autoescape= keyword somewhere on the same line. Two-regex form so
+    // nested parens (e.g. PackageLoader("app", "templates")) inside the
+    // Environment(...) call don't break the match.
+    const envAssignRe = /\b([A-Za-z_]\w*)\s*=\s*Environment\s*\(/;
+    const autoescapeOnRe = /\bautoescape\s*=/;
+    // Explicit "off" forms that must NOT be recognized.
+    const autoescapeOffRe = /\bautoescape\s*=\s*(?:False|None|0)\b/;
+    const envVars = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const m = envAssignRe.exec(lines[i]);
+        if (!m)
+            continue;
+        if (!autoescapeOnRe.test(lines[i]))
+            continue;
+        if (autoescapeOffRe.test(lines[i]))
+            continue;
+        envVars.add(m[1]);
+    }
+    if (envVars.size === 0)
+        return sanitizers;
+    // Emit at every `<env>.get_template(...).render(...)` chain.
+    for (const envVar of envVars) {
+        const renderChainRe = new RegExp(`\\b${envVar}\\s*\\.\\s*get_template\\s*\\([^)]*\\)\\s*\\.\\s*render\\s*\\(`);
+        for (let i = 0; i < lines.length; i++) {
+            if (!renderChainRe.test(lines[i]))
+                continue;
+            sanitizers.push({
+                type: 'python_jinja_autoescape',
+                method: 'render',
+                line: i + 1,
+                sanitizes: ['xss', 'external_taint_escape'],
+            });
+        }
+    }
+    return sanitizers;
+}
 // ---------------------------------------------------------------------------
 // Sprint 70 (#151) — external-secret-exfiltration composed-flow detection.
 //
@@ -3430,4 +3740,368 @@ export function findRustPatternFindings(code, file) {
     }
     return out;
 }
+// ---------------------------------------------------------------------------
+// Sprint 78 (#190) — Tier-2 misconfig pattern extensions for Rust, Java, Go,
+// and JS that the dedicated misconfig passes don't yet recognize.
+// ---------------------------------------------------------------------------
+/**
+ * Rust `hardcoded-credential` (CWE-798). Pattern:
+ *   `(pub|const|static) <NAME>: &str = "literal";` where NAME matches
+ *   /api[_]?key|secret|token|password|passwd|pwd|auth/i and the literal is
+ *   non-trivial (length > 8 and not a placeholder).
+ */
+export function findRustHardcodedCredentialFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const re = /\b(?:pub\s+)?(?:const|static)\s+([A-Z][A-Z0-9_]*)\s*:\s*&\s*'?[a-z_]*\s*str\s*=\s*"([^"]+)"/;
+    const nameRe = /(?:^|_)(?:API[_]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PWD|AUTH)(?:_|$)/i;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        const m = trimmed.match(re);
+        if (!m)
+            continue;
+        const name = m[1];
+        const value = m[2];
+        if (!nameRe.test(name))
+            continue;
+        if (value.length < 8)
+            continue;
+        if (/^(?:xxx|todo|fixme|placeholder|changeme)/i.test(value))
+            continue;
+        out.push({
+            id: `hardcoded-credential-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'hardcoded-credential',
+            cwe: 'CWE-798',
+            severity: 'high',
+            level: 'error',
+            message: `Hardcoded credential: const ${name} contains a literal secret value`,
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Rust `insecure-cookie` (CWE-1004 / CWE-614). Pattern:
+ *   `Cookie::build(...)` chain that explicitly calls `.secure(false)` or
+ *   `.http_only(false)` (or both). The dedicated `insecure-cookie-pass.ts`
+ *   handles the `format!("Set-Cookie: ...")` shape but not the actix-web
+ *   builder chain.
+ */
+export function findRustInsecureCookieFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const builderRe = /\bCookie\s*::\s*build\s*\(/;
+    const insecureFlagRe = /\.\s*(?:secure|http_only)\s*\(\s*false\s*\)/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        if (!builderRe.test(trimmed))
+            continue;
+        if (!insecureFlagRe.test(trimmed))
+            continue;
+        out.push({
+            id: `insecure-cookie-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'insecure-cookie',
+            cwe: 'CWE-1004',
+            severity: 'medium',
+            level: 'warning',
+            message: 'Insecure cookie: Cookie::build chain disables Secure / HttpOnly flag(s)',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Rust `jwt-verify-disabled` (CWE-347). Pattern:
+ *   `.insecure_disable_signature_validation()` method call on a
+ *   jsonwebtoken `Validation` value. Any presence of this method
+ *   disables the signature check.
+ */
+export function findRustJwtVerifyDisabledFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const re = /\.\s*insecure_disable_signature_validation\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        if (!re.test(trimmed))
+            continue;
+        out.push({
+            id: `jwt-verify-disabled-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'jwt-verify-disabled',
+            cwe: 'CWE-347',
+            severity: 'critical',
+            level: 'error',
+            message: 'JWT signature verification disabled: ' +
+                'Validation::insecure_disable_signature_validation() forfeits signature enforcement',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Rust `weak-crypto` (CWE-327). Pattern (raw ECB via `aes` crate):
+ *   any line that calls `.encrypt_block(` or `.decrypt_block(` on a
+ *   block-cipher receiver constructed via `Aes128::new` / `Aes192::new` /
+ *   `Aes256::new` / `Aes128Ecb` / `Aes256Ecb`. We collect the cipher
+ *   constructor lines in a first pass (variable name → seen) and emit
+ *   on every `.encrypt_block(` / `.decrypt_block(` line in the same file.
+ *
+ *   The wrapped CBC/GCM/CTR forms go through `Cbc::<Aes128, ...>::new`
+ *   or `Aes128Gcm::new` — those do NOT call `.encrypt_block` directly
+ *   and so are not matched.
+ */
+export function findRustWeakCryptoEcbFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const ctorRe = /\bAes(?:128|192|256)(?:Ecb)?\s*::\s*new\s*\(/;
+    const blockOpRe = /\.\s*(encrypt_block|decrypt_block)\s*\(/;
+    // First: confirm the file uses raw block-cipher construction (Aes*::new)
+    // — without that, a stray `.encrypt_block(` on some other type isn't
+    // necessarily ECB.
+    let sawCtor = false;
+    for (const line of lines) {
+        if (ctorRe.test(line)) {
+            sawCtor = true;
+            break;
+        }
+    }
+    if (!sawCtor)
+        return out;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        if (!blockOpRe.test(trimmed))
+            continue;
+        out.push({
+            id: `weak-crypto-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'weak-crypto',
+            cwe: 'CWE-327',
+            severity: 'high',
+            level: 'error',
+            message: 'Weak crypto (ECB mode): raw Aes::encrypt_block/decrypt_block ' +
+                'leaks repeating-block patterns. Use AES-GCM, AES-CTR, or ' +
+                'AES-CBC with an HMAC.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Java pattern findings — Sprint 78 (#190):
+ *   - `jwt-verify-disabled` (CWE-347): bare `JWT.decode(<token>)` on the
+ *     auth0 `com.auth0.jwt.JWT` class. `decode` is documented as
+ *     "decode the token without performing any verification"; only
+ *     `JWT.require(...).build().verify(token)` enforces the signature.
+ *   - `tls-verify-disabled` (CWE-295): anonymous `X509TrustManager`
+ *     implementation whose `checkServerTrusted` body is empty
+ *     (returns void without raising). This trust-nothing implementation
+ *     accepts every certificate.
+ */
+export function findJavaPatternFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    // jwt-verify-disabled: `JWT.decode(<expr>)`. Anchored to the `JWT.`
+    // receiver to avoid matching unrelated `decode(` calls on Base64,
+    // URLDecoder, etc. Guarded against the safer `JWT.require(...).build()
+    // .verify(...)` chain by requiring `decode` to appear without
+    // `.verify(` later on the same line.
+    const jwtDecodeRe = /\bJWT\s*\.\s*decode\s*\(/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        if (!jwtDecodeRe.test(trimmed))
+            continue;
+        if (/\.\s*verify\s*\(/.test(trimmed))
+            continue;
+        out.push({
+            id: `jwt-verify-disabled-${file}-${i + 1}-decode`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'jwt-verify-disabled',
+            cwe: 'CWE-347',
+            severity: 'critical',
+            level: 'error',
+            message: 'JWT signature not verified: auth0 `JWT.decode(token)` parses ' +
+                'without checking the signature. Use `JWT.require(<algorithm>)' +
+                '.build().verify(token)` to enforce verification.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    // tls-verify-disabled: anonymous X509TrustManager with empty
+    // checkServerTrusted body. Two-pass: locate the anonymous-class start
+    // line (`new X509TrustManager() {`), then scan ahead for the
+    // `checkServerTrusted(...)` method signature whose `{...}` body is
+    // empty (no `throw`, no `if`).
+    const anonStartRe = /\bnew\s+X509TrustManager\s*\(\s*\)\s*\{/;
+    const checkServerSig = /\bcheckServerTrusted\s*\([^)]*\)\s*(?:throws\s+[^\{]*)?\{\s*\}/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        if (!anonStartRe.test(raw))
+            continue;
+        // Scan up to 15 lines ahead for the empty-body checkServerTrusted.
+        const end = Math.min(lines.length, i + 16);
+        let foundAt = -1;
+        for (let j = i; j < end; j++) {
+            if (checkServerSig.test(lines[j])) {
+                foundAt = j;
+                break;
+            }
+        }
+        if (foundAt < 0)
+            continue;
+        out.push({
+            id: `tls-verify-disabled-${file}-${foundAt + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'tls-verify-disabled',
+            cwe: 'CWE-295',
+            severity: 'high',
+            level: 'error',
+            message: 'TLS certificate verification disabled: anonymous X509TrustManager ' +
+                'with empty checkServerTrusted body accepts every certificate.',
+            file,
+            line: foundAt + 1,
+            snippet: lines[foundAt].trim().substring(0, 100),
+        });
+    }
+    return out;
+}
+/**
+ * Go pattern findings — Sprint 78 (#190):
+ *   - `weak-crypto` (CWE-327): raw ECB usage via `aes.NewCipher(...)`
+ *     followed by a direct `<cipher>.Encrypt(` / `.Decrypt(` call on the
+ *     constructed value (no `cipher.NewCBCEncrypter` / `NewGCM` / `NewCTR`
+ *     wrapper). The Go stdlib `aes.Cipher` exposes `Encrypt` / `Decrypt`
+ *     that operate on a single 16-byte block — calling these directly is
+ *     ECB mode.
+ *
+ *   Algorithm:
+ *     1. Collect every `<v>, _ := aes.NewCipher(...)` cipher variable.
+ *     2. If the file contains a `cipher.NewGCM(<v>)` / `cipher.NewCBC*(<v>)`
+ *        / `cipher.NewCTR(<v>)` wrapping line for that variable, skip it
+ *        (wrapped mode is not ECB).
+ *     3. Otherwise emit on every `<v>.Encrypt(` / `<v>.Decrypt(` line.
+ */
+export function findGoPatternFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const cipherVars = new Set();
+    const ctorRe = /\b([a-zA-Z_]\w*)\s*(?:,\s*[a-zA-Z_]\w*)?\s*:?=\s*aes\.NewCipher\s*\(/;
+    for (const line of lines) {
+        const m = line.match(ctorRe);
+        if (m)
+            cipherVars.add(m[1]);
+    }
+    if (cipherVars.size === 0)
+        return out;
+    // Drop wrapped ciphers (CBC/GCM/CTR/OFB/CFB) — those are not ECB.
+    for (const v of Array.from(cipherVars)) {
+        const wrapRe = new RegExp(`\\bcipher\\.New(?:GCM|CBCEncrypter|CBCDecrypter|CTR|OFB|CFBEncrypter|CFBDecrypter)\\s*\\(\\s*${v}\\b`);
+        for (const line of lines) {
+            if (wrapRe.test(line)) {
+                cipherVars.delete(v);
+                break;
+            }
+        }
+    }
+    if (cipherVars.size === 0)
+        return out;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//'))
+            continue;
+        for (const v of cipherVars) {
+            const opRe = new RegExp(`\\b${v}\\s*\\.\\s*(?:Encrypt|Decrypt)\\s*\\(`);
+            if (!opRe.test(trimmed))
+                continue;
+            out.push({
+                id: `weak-crypto-${file}-${i + 1}`,
+                pass: 'language-sources',
+                category: 'security',
+                rule_id: 'weak-crypto',
+                cwe: 'CWE-327',
+                severity: 'high',
+                level: 'error',
+                message: 'Weak crypto (ECB mode): raw aes.Cipher.Encrypt/Decrypt on a ' +
+                    'block leaks repeating-block patterns. Wrap with cipher.NewGCM, ' +
+                    'cipher.NewCTR, or cipher.NewCBCEncrypter + HMAC.',
+                file,
+                line: i + 1,
+                snippet: trimmed.substring(0, 100),
+            });
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * JS pattern findings — Sprint 78 (#190):
+ *   - `xml-entity-expansion` (CWE-611 / CWE-776): libxmljs `parseXml`
+ *     (and `parseXmlString`) called with `{ noent: true }` resolves
+ *     external entities, enabling XXE / billion-laughs. The default is
+ *     `noent: false`; only the explicit-true form is unsafe.
+ */
+export function findJsPatternFindings(code, file) {
+    const out = [];
+    const lines = code.split('\n');
+    const parseRe = /\blibxml(?:js)?\s*\.\s*parseXml(?:String)?\s*\(/;
+    const noentTrueRe = /\bnoent\s*:\s*true\b/;
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        if (!parseRe.test(trimmed))
+            continue;
+        if (!noentTrueRe.test(trimmed))
+            continue;
+        out.push({
+            id: `xml-entity-expansion-${file}-${i + 1}`,
+            pass: 'language-sources',
+            category: 'security',
+            rule_id: 'xml-entity-expansion',
+            cwe: 'CWE-611',
+            severity: 'high',
+            level: 'error',
+            message: 'XML external entity resolution enabled: libxmljs parseXml ' +
+                'called with `noent: true` resolves external entities (XXE / ' +
+                'billion-laughs). Omit the flag or set `noent: false`.',
+            file,
+            line: i + 1,
+            snippet: trimmed.substring(0, 100),
+        });
+    }
+    return out;
+}
 //# sourceMappingURL=language-sources-pass.js.map